they are optional?! last time i installed windows it didnt give me a choice..

They are mandatory in a default OOBE FRX, if the OOBE is customized, they may be optional. The NTLM specification does not make them mandatory.

Does Windows even give you a choice anymore? 💀

im not sure if you were trying to say windows was threatening you or your install experiences didnt have more options?

When installing windows don't set a password, leave it blank. After the OS finishes installing, open cmd as admin and run "net user (yourusername) (password)"

That will set a password for your account with no security questions.

@@idkShiba Don’t set a password when you first set up Windows (OOBE). After you get to the desktop, press ctrl-alt-del and select Change a password.

Another way to avoid it may inquire that you use a Microsoft Account, bc I didn’t have to set up security questions when linking my acc to Windows, but it did show the security questions for a local account

The way I get around it: I don't set any password during OOBE, yes you can just press enter to continue, it accepts no password too, and set a password later on manually with net user through the Command Prompt.

@@3angleboi What’s the full cmd to do it / instructions?

@@supergamerisawesome6158 net user YourUserName YourPassword

Security questions are not required when you make the account without password.

@@teknixstuff Exactly what I meant. Security questions won't even pop up if the password is left empty.

Just type in an answer with a whole bunch of random numbers and letters that don't mean anything

@@corey7219 Some years ago when I set up some computers at a place, I used imaginary answers for the security questions and I wrote them down into a txt on another computer then saved it onto the admin's pendrive.

@@Fredomnomyes but not to niche audiences

@@corey7219 You totally missed the point.... your answers can be read by any software running  on the machine that can read the registry keys. Meaning your account can be compromised.

@@idkShiba today helping someone install windows and i see what you mean

@@Endermanch Thats not True. If you use OOBE. You can still bypass it. After you did the OOBE bypass nro, and you are now creating the user. Fill in the username and No password, in that case you dont get it. You can later set the password after the installation.


It got cut off to "DO NOT use Windows" lol<br>still true

It got cut off to "DO NOT use Windows" lol
still true

it should be "do not use windows 11".....

@@najwiekszypechowiec and use any other version of Windows? I have to disagree

@@najwiekszypechowiec They pretty much mastered windows at windows 7, after that it has been downhill enshittification since :/

If the windows releases after 7 were like windows 7 but with the multiple desktop feature, giving more user choice to customise the GUI and some additional features(that users could switch off/choose not to install) then it would have been the best...but as nope we got windows 10 and especially windows 11 now with all this horrible telemetry and other "features" forced down us....

win 10 long term support was peak windows

@@proximalelk6186 still better than linux


I just found this short 4 minutes after it released lol.

I just found this comment 12 minuted after it got published lol.


You forgot to mention one thing, to access the SAM key, you need higher permission level, a regular administrator account isn't enough, You can access it in two ways, either by using Windows PE, or by executing regedit with the NT AUTORITY/SYSTEM account (you can do that with a tool called "Process Hacker"), then you're good to go lol

You can use Regedit in WinRE on a recovery drive to access it as well

@@DamariobrosWindows RE and Windows PE are basically the same thing, but yeah (I'm not talking about the modified versions of windows pe tho lol)

It's their bread and butter to not mention these things. If they didn't disable Syskey, Kerberos, BitLocker, MS accounts, <i>THE WHOLE OPERATING SYSTEM</i> etc., there wouldn't be a video.

It's their bread and butter to not mention these things. If they didn't disable Syskey, Kerberos, BitLocker, MS accounts, _THE WHOLE OPERATING SYSTEM_ etc., there wouldn't be a video.

WIndows PE/RE are useless with BitLocker, except of course you have the recovery key, then you are admin of course.

@@WinDGDevnot basically they ARE the same thing

@@throwaway6478 tho I think they mentioned this in the full video... And well, in case you didn't know, all the things You have mentioned here aren't the "whole operating system", they are just "security" features.


Arent you obligated to add them if you use an offline windows account?

yup, i use an offline account and as far as i can tell i cannot skip it :(

Don’t set a password when you first set up Windows (OOBE). After you get to the desktop, press ctrl-alt-del and select Change a password.

Set the password in the control panel, and then you don't need to set these questions.

@@windestruct Yeah, naw bud. That's like putting a stick in your own bike tire spokes and calling it an upgrade when you land on your face.


Microsoft marketing so much about "security". Looks very secure to me!


Last thing I expected was for them to be stored in plaintext


Have you reported this security issue to microsoft?

@@alekslevet don't really think they care but they are forced to because they don't want the risk of negative PR.


If bitlocker isn't enabled you can just load the SAM file through an recovery stick and do stuff like enabling the admin account which has at default no password.


ooh, you should make a new creepypasta malware with this script combined with whatever you've already done


If you make an account, set it up without a password and Windows will not ask for the security questions! Then after you first install, immediately set a password using command prompt as admin and type “net “your_user_name” password” and there you go! Of course remove the quotations. That’s how I’ve been doing it for years.

You can also go the Ctrl+Alt+Delete menu to change the password without having to set those questions

@@TheCoder55 I forgot about that way as well!


I forgot what it was called but those “there is no escape” security questions were a reference to an older video I think.


The most insulting part is you're forced to use security questions in the OOBE, and the only way out of it is to not create a password until you get out of OOBE.


The second short ever made on this channel


The way you can avoid the security questions is by adding a password to your user AFTER you installed Windows. If you do this, you will only have a password hint.

I mean yeah a lot of ppl aren't gonna use unattended install anyways if that what you're talking about


When any password or security text is in plaintext you know there’s an issue


bold of you to assume i actually use security questions at all


Unfortunately Windows security is not designed to support "tech-savvy" people, just a little privacy in homes and offices.


I didn't have the option when buying a new PC, it wouldn't let me connect to wify and I had to ask questions if or if, then I already added Microsoft account when I had wifi.


Hey so how about you update no escape to have the security questions as THERES NO ESCAPE?


Alright but then what security settings do you recommend


oh I'm gonna have a lot of fun with this


So what? Why should an attacker do that? That would be atupid from an attacker perspective, making a bat that logs the user out at startup does the same, with less hassle, not rly a problem


my security questions are just “1” “2” and “3” so it doesn’t matter


could they maybe be randomized with a random string on each boot so that a attacker has a harder time if also using bitlocker?<br>but why bother the cmd trick is still not patched.

could they maybe be randomized with a random string on each boot so that a attacker has a harder time if also using bitlocker?
but why bother the cmd trick is still not patched.


Can we avoid using them? OOBE\BYPASSHIT<br>Otherwise can't i simply delete this key? Or is it going to leave blink valid since the json is null

Can we avoid using them? OOBE\BYPASSHIT
Otherwise can't i simply delete this key? Or is it going to leave blink valid since the json is null


I just used security questions when setting up windows 10, and yet I don't think there is a way to bypass it.

I'm stupid


That's why i am using CMD to set the password


Really shouldn't even have it stored at all like that


Gotta tell my mum she has to remove it 😂


Bruh, why should I need to skip this OOBE Setup??


"Good" "security" MICROSOFTTT

Don't know what else to say or if it means much but thanks for showing this Andrew


What? This is the dumbest way to save answers to a security questions. The answers need to be save as a hash, like a password.


YOU HAVE A VOICE , LIKE A DANIEL MYSLIVETS?


All it takes is someone with enough time to look in the registry and copy down the security answers.  Assuming the managed to log in or it was left logged in.  With this and Microsoft trying so hard to force us to the cloud I think it i time to ditch them!  They were lazy or sloppy with the security in Windows and now they also have that Recall that they want to use to see everything that was ever on our screen.  It becomes obvious to me that this is no good at all!  Who in their right mind would give up system resources like CPU time and disk space just so that someone could spy on us?  Those who actually accept it knowingly are the ones who I imagine are the easiest to brainwash and gaslight and for their heresies they probably deserve the misery!!


I just spammed something random to it.. LOL


i didn't know you sausages to use your voice in videos!


Video zu 20/28 geschaut... Wo ist das gottlose Gespräch?


i just enter random stuff or "a" so who cares


I dont enjoy using Linux at all but is Windows made by complete morons?! It's the only OS that just works but underneath it it's such a Frankenstein build.


Windows has never been a secure os, I'm not surprised. This doesn't really matter though, if you are going through the effort to do this, you can just change the password hash to a new one and log in. I hope this is patched in active directory though, even though important businesses probably use bit locker.


It doesn't really matter since you can bypass a users passwords in ~10 minutes anyways


Better yet if you are able to:
Don’t ever use windows
Period


Unfortunately you're forced to set them when configuring an account password. The best solution is to just set them to long random strings that nobody will ever be abge to guess.


This is the main reason that I am going to go through tiny 11 just because of this reason security


dont tell us that the last part of the vid was a no escape update


Dude stop posting videos in the wrong format, don't use portrait mode

its a short video watch the full video if you dont want portrait


Windows is too much garbage through the years being held by cheap tape trying to not fall into hundred pieces.


And when somebody will tell them this they'll just answer "well, you should've made an online account"

Or used BitLocker, or Syskey, or Kerberos - or any of the other security features of Windows you have to disable for these "tricks" to work.


Honestly at this point just don’t use windows 😂


b-b-b-but security, b-b-but the trust of Microsoft in Edge


But what if Windows won't let continue without setting the security questions when setting a password?! 🤨

In my head it doesn't make sense on how they just don't make it optional 😑

@@YesThatBoyIsAJoJo It's Microsoft, what do you expected?


Here's a better lesson we learned. Don't use windows at any cost.


Looks like theresnoesape.exe virus remade or homemade


- BitLocker joins this group<br>- Enderman left the chat

- BitLocker joins this group
- Enderman left the chat


although i don't really know what's the risk here, yes sure it's in plain text, but it's not exactly "right there", it's sort of hidden and if you know howwhere it is and how to compile a program to extract them, why are you wasting time on something that can be changed or disabled when you can spend it on, idk, getting saved passwords from browsers. if you're a hacker and and want to break in in someone's pc, you need either physical access or the password, even if you knew where to find the security questions, you still need to access the system to access and it's not an issue if the attack is from inside the system because if they want your passwrd, they would use a keylogger or whatever, and then encrypt it to lock you out. why would you need to know where the person's parents first met if you can just access the computer in other ways. this is also something that was basically just discovered recently and  now we might actually  have a bit more hackers trying to get people's security questions, instead of keeping this a sort of a secret and reporting it to MS like you should. let's go back to when no one knew that you could steal kias with a usb lead, you're the first person to discover that, you wouldn't just film a video on how to do it and then go back to doing whatever you were doing, no, you contact kia and tell them like a proper, normal, likeable person


Todays lesson! Don’t use Windows! (Is joke pls don’t cancel me on every platform)