This guide turns a Windows PC into a crypto appliance: a machine whose only job is to talk to your hardware wallet and a short list of verified sites. The reasoning lives in the Security Guide; this page is the doing. It matters more on Windows than anywhere else — the malware economy overwhelmingly targets Windows, and modern infostealers specifically hunt browser profiles and wallet extensions. Everything here is universal — no particular token, chain, or protocol required.
Time: about an hour, most of it waiting on updates.
Step 0 — The One Disqualifying Check
Press Win+R, type winver, press Enter.
- Windows 11 — proceed.
winveralso shows the version (for example 25H2), and security updates depend on it: Microsoft’s Windows 11 Home and Pro lifecycle page lists each version’s end date. For Home and Pro, 23H2 and older have ended and 24H2 ends 2026-10-13; on any of those, Step 2 includes the feature update Windows Update offers. - Windows 10 — stop. Windows 10 reached end of support on 2025-10-14 (Microsoft’s consumer ESU runs to 2027-10-12). Unless the machine is enrolled in Microsoft’s Extended Security Updates program (check Settings → Update & Security → Windows Update), it has been unpatched for months and must not touch crypto — and even ESU is a countdown, not a fix. If the hardware supports it (Microsoft’s PC Health Check app says whether this PC qualifies), upgrade to Windows 11 free via Settings → Update & Security → Windows Update. If it doesn’t, take the machine off crypto duty — an unpatched OS outranks every other risk on this page.
(A Windows laptop on an ARM chip, such as Snapdragon X, runs the same Windows 11 steps. The hardware-wallet software is the exception: as of September 2026, the system requirements for Ledger Wallet (formerly Ledger Live) list Windows arm64 as unsupported, and Trezor publishes its desktop Suite for Windows x64 only, although Trezor’s web Suite runs in a Chromium browser. Each vendor’s system-requirements page settles whether a given wallet works on an ARM laptop.)
Step 1 — If This Will Be a Dedicated Machine, Start Clean
Settings → System → Recovery → Reset this PC → Remove everything, and choose Cloud download. Remove everything erases this PC’s personal files, apps and settings, browser wallet extensions and desktop wallet apps included. A software wallet (MetaMask, Rabby, Internet Money…) comes back afterwards only from its written Seed Phrase, so one whose Seed Phrase exists only on this PC is gone with it; a hardware wallet’s keys stay on the device. A from-scratch Windows is the only way to be sure no past download rides along. Skip if hardening your everyday PC — the rest still applies.
One fact stated early because it decides everything: pirated software is a leading way infostealers reach a machine. A cracked installer runs with the owner’s permission, and the infostealers it carries hunt wallet extensions.
Step 2 — Update Until There’s Nothing Left
Settings → Windows Update → install, restart, check again — repeat until clean. Then, under Advanced options, turn on “Receive updates for other Microsoft products” and leave automatic updates alone forever.
Step 3 — Demote Yourself
Settings → Accounts → Other users → Add account creates a second account (Windows pushes for a Microsoft email; for a local account, choose I don’t have this person’s sign-in information, then Add a user without a Microsoft account). Open the new account’s entry → Change account type → Administrator. Sign out, sign in to the new Administrator account, and change the daily crypto account to Standard User the same way. Malware in a standard account can’t silently change the system; the elevation prompt is your alarm bell. (Windows needs at least one admin account to exist — it just shouldn’t be the one you live in.) Steps 4–6 change system settings and are done signed in to an Administrator account. Steps 7–9 happen in the daily Standard account, where the browser, its extensions and its bookmarks live; Windows asks for the Administrator password when an install needs it.
Step 4 — Turn On BitLocker
Settings → Privacy & security → Device encryption (or search “BitLocker”). Turn it on. One catch the Settings screen never mentions: on any Windows 11 PC set up with a Microsoft account, Device encryption saves the recovery key to that account automatically — there is no “write it down” prompt. After turning it on, open aka.ms/myrecoverykey in any browser, copy the 48-digit key onto paper with your physical backups, then delete the cloud copy — otherwise the account takeover we defend against in 2FA hands an attacker your disk key. (On Windows 11 Pro, search “Manage BitLocker” and choose “Print the recovery key”; the aka.ms/myrecoverykey check and the cloud-copy deletion apply to Pro as well.) Then confirm in Settings that encryption shows as complete. A stolen PC becomes a brick instead of a leak.
Step 5 — Let Defender Do Its Job, and Add Smart App Control
- Windows Security → Virus & threat protection — confirm real-time protection is ON. Microsoft Defender is genuinely good now; installing a third-party antivirus switches Defender’s real-time protection off and adds one more program with deep system access.
- Windows Security → App & browser control → Smart App Control — ON. It stops unsigned and untrusted programs outright. (Since Microsoft’s April 2026 update, rolling out gradually, Smart App Control switches on here without a reinstall. It stays unavailable while the PC is in S mode or has Windows’ optional diagnostic data turned off. Microsoft’s fix for S mode is to switch S mode off and then reset the PC; for diagnostic data it is a reset that sends optional diagnostic data, a question Step 1’s setup screens ask.)
- Same screen: Reputation-based protection — everything ON.
Step 6 — Strip It Bare
Uninstall everything you don’t recognize or need (Settings → Apps). The target state: Windows, the one browser used for signing, your hardware-wallet software and, if you run one, a VPN app — nothing else. (Microsoft Edge ships as part of Windows and cannot be uninstalled outside the EU/EEA; on this machine it stays unused.) No email client, no Discord, no Steam, no utilities. Every program is attack surface, and on Windows the attackers have the biggest arsenal.
Step 7 — Install the Short List
- A browser — on a dedicated machine, only the signing browser, Brave, set up per the Browsers guide: bookmarks-only navigation, and its only extensions are one wallet extension and Bitwarden. The Browsers guide’s second, research browser (Firefox + arkenfox) belongs on your everyday machine, since nothing on this one browses; on a hardened everyday PC, both apply.
- Your hardware-wallet software for the device you own: Trezor Suite from
trezor.io/start, or Ledger Wallet (formerly Ledger Live) fromledger.com/start. Download it by typing that exact web domain yourself and checking it letter by letter, not from a search result or a link. Sponsored search ads impersonating wallet vendors are a perennial, documented theft vector. - Optional: a VPN app chosen from the Security Guide, downloaded the same way.
Step 8 — Build the Bookmark List, then Never Type Again
Bookmark, typing each one yourself once: your block explorer and the app(s) you use; the site’s verified starter list, character for character, is Bookmarkable Pages. This machine reaches the web only through those bookmarks from now on. Before any contract interaction, verify the address against the app’s official docs; for Actuator, the Manual’s Appendix A lists the contracts and links Actuator’s official list.
Step 9 — The Habits That Keep It Sealed
- Updates installed the week they ship keep the machine’s defenses current; a stale machine protects nothing
- Each email opened, site browsed or file downloaded here widens what an attacker can reach; updates to Windows and the Step 7 programs are the only downloads this machine needs
- The optional VPN from Step 7, while switched on, keeps this machine’s IP address from the sites and nodes it reaches and the contents of its traffic from the local network, home network included
- The hardware wallet’s screen is the final word on every transaction: what it shows is what you sign
Prefer to sidestep the Windows malware ecosystem entirely? A minimal, auto-updating Linux installed on the same PC and used only for crypto is a real option — honest caveat: only if you’ll keep it current. The trade-offs are in the Security Guide.
Everything on this page is universal — send anyone the link — pointing people to the source beats forwarding copies (a file passed around is exactly what this site warns about; the address stays canonical and current). For the curious: this site documents Actuator.Finance on PulseChain — the one-page version is How It Works, and Start Here picks your path.