Using VHD for surfing the web

Hi peoples.

So I have my laptop as offline machine only. I update it from time to time.

I still need to access the web every now and then but I use a different system for that.
I was thinking though to setup a VHD Win11 OS (with browser and other stuff I don't want polluting my offline OS) and use that to surf the web when I need to as I saw you can add a VHD to the boot menu and thus boot into it as if it was a dual boot machine.

I would like to know if any of you are doing this?
Do you advise against it or is it a decent idea?
What are the security drawbacks my non-VHD (offline system) could face?
Would I be able to transfer docs from the VHD to my offline OS?

Appreciate your views
R

Hi, @ronald dietrich, and welcome to Eleven Forum (aka 11F).

I personally do not directly boot .VHD/X on my machines, but plenty here do. I do, however, have plenty of Virtual Machines on my PC that I do make use of directly, and I can unequivocally say that, as long as the proper features are enabled in the VM, file transfer between the host machine and the VM is no problem. However, when booting from .VHD/X itself, it will probably be a little differently achieved, but still should be achievable.

As for advising to do it or not, once you have it set up it should be relatively easy to do - however, if the machine you plan to boot on it set up as offline, does that mean only when booting from the .VHD/X will you enable networking components to access the Internet?

Also, there might be easier (at least in terms of setup) to accomplish this, but since I deal strictly with VMs I'll let those that boot directly chime in.

@Bree for one stated in another thread that he boots at least one instance via .VHD/X, so I've tagged him for this thread.

Creating native boot vhdx files is a great way of creating a dual/multi boot pc.

Just be aware that if you get a virus or malware in vhdx file, you can potentially infect host OS.

So image backups are obviously important.

johnlgalt said:

however, if the machine you plan to boot on it set up as offline, does that mean only when booting from the .VHD/X will you enable networking components to access the Internet?

Also, there might be easier (at least in terms of setup) to accomplish this, but since I deal strictly with VMs I'll let those that boot directly chime in.

@Bree for one stated in another thread that he boots at least one instance via .VHD/X, so I've tagged him for this thread.

Click to expand...

Thank you john.
Yes, the idea would be using non-VHD system offline then when necessary reboot into the VHD OS and surf the web enabling the network for it.
I know Sordum has a tool that enables adding a VHD to boot menu so I think (have not tried it) I will be set in that regard.

cereberus said:

Creating native boot vhdx files is a great way of creating a dual/multi boot pc.

Just be aware that if you get a virus or malware in vhdx file, you can potentially infect host OS.

So image backups are obviously important.

Click to expand...

Thank you cerebrus.
Well, I was actually looking into this to minimize exposure of the offline host OS.
So, am I correct in thinking this security wise won't be any different from setting up a normal dual-boot?
Or a little better? Do you have any advice on hardening security of the VHD to avoid any problems?
My purpose would be to set up something that would allow me to secure and compartmentalize the work PC and the occasional web surfing.

Regards
R

By the way, thank you for the welcoming! Appreciate it.

ronald dietrich said:

I was thinking though to setup a VHD Win11 OS (with browser and other stuff I don't want polluting my offline OS) and use that to surf the web when I need to as I saw you can add a VHD to the boot menu and thus boot into it as if it was a dual boot machine.

I would like to know if any of you are doing this?

Click to expand...

Welcome to Eleven Forum....

johnlgalt said:

@Bree for one stated in another thread that he boots at least one instance via .VHD/X, so I've tagged him for this thread.

Click to expand...

I actually have one machine that quadruple-boots, it has a standard Windows install plus three native boot VHDX.

Do you advise against it or is it a decent idea?

Click to expand...

It's by far the easiest way to dual boot. It doesn't make any changes to the conventionally installed OS apart from adding a BCD boot entry. And its as easy to remove a vhdx as it was to set up, you basically just delete the vhdx file and the boot entry..

What are the security drawbacks my non-VHD (offline system) could face?

Click to expand...

I do not boot from vhdx for security, I do so because I want to test several of the Insider builds on real hardware rather than in a VM. Although it's a 'virtual' disk, the OS running from it has direct access to all the hardware like any normally installed OS. As such, it would offer no real protection from determined malware. By default the partition with your 'offline OS' would be visible as a drive letter in the File Explorer of your vhdx system. While you could hide that drive by removing it's assigned letter, it could still be accessed by some types of malware.

Would I be able to transfer docs from the VHD to my offline OS?

Click to expand...

Yes, see the bit about drive letters above. You could also write to a usb drive from the vhdx system, then read it back in the 'offline system', both can see and use all the hardware on your system while they are running. A third way is that your offline system could mount the vhdx file and read/write to it like any other drive.

If security is your overriding concern, then running the second OS as a virtual machine is the safe solution. If your Windows is Pro then you have Hyper-V available for that, if it is Home then you could use VirtualBox or VMWare Player.

ronald dietrich said:

Thank you john.
Yes, the idea would be using non-VHD system offline then when necessary reboot into the VHD OS and surf the web enabling the network for it.
I know Sordum has a tool that enables adding a VHD to boot menu so I think (have not tried it) I will be set in that regard.


Thank you cerebrus.
Well, I was actually looking into this to minimize exposure of the offline host OS.
So, am I correct in thinking this security wise won't be any different from setting up a normal dual-boot?
Or a little better? Do you have any advice on hardening security of the VHD to avoid any problems?
My purpose would be to set up something that would allow me to secure and compartmentalize the work PC and the occasional web surfing.

Regards
R

Click to expand...

It is no different from traditional dual boot security wise.

You can remove drive letter of work OS drive when using personal OS etc, use a standard account on personal OS etc. to reduce cross infection risk, but the oxymoronic common sense is a key attribute.

In the end, it is better to use a virtual machine for the personal installation, or even better a separate pc.

I run a dual boot with a vhdx file on my primary machine. I'm running windows 10 natively on it, and it's my everyday use/gaming PC and it's been running fantastic. 0 problems.

I wanted to ensure that all of the hardware would work with Windows 11 on the box. In the past, I would just unplug my main drive, put in a spare drive and install the OS there and test it.

However, with my drives now being NVMe's, and stuck under my video card and such, it's a pain to change the drive. So, I went instead to native booting from a .VHDX file and its been great. Feels exactly the same as my actual OS and hardware, I'm just limited to the 100GB that I allocated to the .vhdx file.

The only downside I see, is that it takes a fair bit more time for my system on startup to get to to the desktop. It runs for a bit, then loads the boot menu, and then I make my OS choice..from there it's fast and right into the OS, but it probably added an additional 10 seconds to my boot time. This is of no real concern for me, just mentioning it.

I never considered throwing WinX into a VHD for gaming. I might have to consider that, as I could probably get a bit better performance doing it that way.

@ronald dietrich - there you have it.

The one significant thing I can see with going the VM route is that, for the VM to have Internet access, you'd have to be running the host machine, which would also be getting access - unless (I think) you create a virtual adapter in the VM and assign it directly to a physical NIC / Adapter so that it has exclusive use of this.

@Bree @cereberus @pparks1 - is this a valid thought?

Because he absolutely wants the host OS to remain closed off.

If the above is not doable, so that the VM is isolated and is the only entity that has any network access, then it sounds like a VM for the closed system might be the best way to go, as that would be easily achievable - disable the networking in the VM and poof, no networking lol.

And this could be done on either system, even the one that already does access the Internet, so that all of it could be done from the same box, and the VM (and associated VHD/X) would remain independent from network access unless specifically granted at any given time.

johnlgalt said:

I never considered throwing WinX into a VHD for gaming. I might have to consider that, as I could probably get a bit better performance doing it that way.

@ronald dietrich - there you have it.

The one significant thing I can see with going the VM route is that, for the VM to have Internet access, you'd have to be running the host machine, which would also be getting access - unless (I think) you create a virtual adapter in the VM and assign it directly to a physical NIC / Adapter so that it has exclusive use of this.

@Bree @cereberus @pparks1 - is this a valid thought?

Because he absolutely wants the host OS to remain closed off.

If the above is not doable, so that the VM is isolated and is the only entity that has any network access, then it sounds like a VM for the closed system might be the best way to go, as that would be easily achievable - disable the networking in the VM and poof, no networking lol.

And this could be done on either system, even the one that already does access the Internet, so that all of it could be done from the same box, and the VM (and associated VHD/X) would remain independent from network access unless specifically granted at any given time.

Click to expand...

If the vhdx is being natively booted in a dual boot arrangement, the host OS does not need internet access. However the vhdx has access to all drives on pc, unless user locks down access to other Host OS drive.

If the vhdx is running in a virtual machine, the host OS does need internet access. However, vm does not have access to host OS drive, unless it is specifically given.

Yup. That is what I thought. Out of likes for the day, so commenting instead.

johnlgalt said:

The one significant thing I can see with going the VM route is that, for the VM to have Internet access, you'd have to be running the host machine, which would also be getting access - unless (I think) you create a virtual adapter in the VM and assign it directly to a physical NIC / Adapter so that it has exclusive use of this.

@Bree @cereberus @pparks1 - is this a valid thought?

Click to expand...

When you are natively booting from a .vhdx file...you aren't using a virtual machine. It's a full fledged installed machine utilizing the hardware exactly like a physical install to a hard drive. The only difference is that the hard drive itself is not physical, but instead is virtualized and presented as a single file. It's just a dual boot setup, but without having to actually partition your hard drive.

For the above reason, there is no concept of a host OS. The host OS is whichever option you booted to. Thus you can have one with internet and one without.

I think you may have misunderstood me.

cereberus said:

In the end, it is better to use a virtual machine for the personal installation, or even better a separate pc.

Click to expand...

My commentary was based upon this suggestion, specifically the VM part. Which is why I specifically said what I did in that quotation.

johnlgalt said:

I think you may have misunderstood me.



My commentary was based upon this suggestion, specifically the VM part. Which is why I specifically said what I did in that quotation.

Click to expand...

Even if you use a VM there's nothing to stop you using vhdx files on the "Virtual drive" and at the VM boot you can select which windows system you want to boot - so only 1 VM needs to be maintained for as many windows VM's as you have space for on the "Virtual drive".

Here I've got 4 Windows systems in a "Single VM" config.



So on the Virtual drive simply create an efi partition (ONE ONLY) and your vhdx files. The vhdx files should simply be attched and formatted as a bog standard ntfs partition and assigned a letter - then do your install.

So using vhdx files gives you maximum choice and flexibility whether using as full blown VM's or as "Physical Windows machines" == so over to you to decide,


Cheers
jimbo

Completely not what I was talking about, thanks.

johnlgalt said:

Completely not what I was talking about, thanks.

Click to expand...

I'm still not sure what you are talking about.

Running from a vhdx is not a virtual machine, thus there isn't any type of virtual adapter or what not that can be attached to it to get internet access. It's running on the actual hardware and has 100% access to the NIC just like Windows physically installed on the hard drive.

And Cerebus' suggestion was to run a VM. I was replying to that.

My last post was in reply to Jimbo. Not you.