A hardened, isolated Windows 10 in VirtualBox
win10-hardened-lab
VirtualBoxPowerShell
cloudflaredWindowsWhat it is
A defensively-configured Windows 10 Pro workstation in VirtualBox, isolated from external factors, with all DNS egress forced through Cloudflare over DoH and plaintext DNS blocked. It keeps outbound internet — that's the point of egress filtering — but is otherwise locked down.
Proof
$ Resolve-DnsName example.com -Server 8.8.8.8
timed out
# plain DNS is closed, only DoH remains
Key decisions
01NAT, zero inbound
Outbound egress for Cloudflare filtering with no inbound at all; the VM never appears on the real LAN, and RFC1918 egress is blocked for defence in depth.
02Cloudflare DoH, :53 blocked
Encrypted, filtered name resolution that can't be bypassed. Windows 10 has no native DoH, so cloudflared runs as a local proxy pinned in the hosts file; nothing plaintext ever leaves.
03Platform integrity
EFI + Secure Boot + TPM 2.0 — a modern trusted platform that enables BitLocker-with-TPM and VBS / Credential Guard.
04Host↔guest channels closed
Clipboard, drag-and-drop, USB, audio and VRDE off; SMBv1 removed, RDP off, LLMNR/mDNS/NetBIOS blocked, Defender + ASR on.
A verified snapshot, clean-hardened-baseline, captures the good state to roll back to. This is a hardened workstation, not a malware detonation sandbox.