Your office can be perfectly secured and it will not matter if the home PC joining it is running pirated software and a two-year-old Windows. The tunnel trusts the machine — so the machine must deserve it.
Every page in this series builds a safe door into the office. This page is about what walks through it. A VPN does not inspect your home PC; it extends trust to it. Malware on a home machine rides the tunnel like an employee. So before any home PC is allowed in, it must pass a minimum hygiene check — not corporate paranoia, just the basics that make the connection defensible. Run through this list with each staff member once; it takes fifteen minutes per machine.
Windows must be fully updated — not 'updates paused since 2023', but current, with no restart pending for weeks. Antivirus (Windows Security is fine) must be on, green, and never disabled 'because it blocked a download'. These two are the floor, not the ceiling: the majority of real-world infections walk through unpatched systems and silenced antivirus, not through sophisticated hacking. If a home PC cannot meet this floor, it does not join. Full stop.
Create a dedicated Windows user account on the home PC for office work, used by the staff member alone. The family account — games, the children's downloads, a cousin's pen drive — stays on the other side of the sign-in screen. This separation is cheap and buys real safety: less junk runs alongside the tunnel, and when the laptop is looked at later, the work profile tells a clean story. The VPN account and the Windows account are both personal; neither is ever shared with family members, however harmless it feels.
Turn on BitLocker where the Windows edition offers it (or the device encryption toggle in Settings on many home editions), so a stolen laptop's disk is not readable by simply removing it. Then set the screen to lock within a few minutes and require the password on wake. A home PC connected to the office, sitting unlocked in a living room, is an office terminal in a public place. These two settings take five minutes and close the entire 'lost or unattended machine' chapter for most small offices.
Some finds end the inspection on the spot: cracked office software or activators, 'free download manager' toolbars, cleaner-booster scareware, a disabled antivirus with exclusions carved out for a favourite crack folder. These are not moral judgements; machines maintained this way are statistically where infections live, and the tunnel would import the risk wholesale. The fix is not punishment — clean the machine properly or use a different one (many offices simply issue a basic office laptop once home working becomes regular, which retires this whole problem).
Fairness matters if you want these rules followed: hygiene is a two-way promise. The office should state in writing what it does and does not do — it does not monitor the home PC, read personal files, or track activity outside the tunnel; it does see VPN connection times and office-side file access, like any office system. Staff who trust the boundary keep the rules. Staff who suspect snooping find workarounds, and workarounds are how the unsafe setups this series replaced came back.
The video shows the connection being made — this page is the checklist to pass before making it.
▶️ Watch Full VideoYes, when it is on, updated and not tampered with. The failures happen when it is disabled, excluded around crack folders, or running on a Windows that has not updated in a year. A clean, current built-in antivirus beats an expensive one that somebody switched off.
With the separate work account, a lock screen and the hygiene checks passed, it can — the work account must belong to the staff member alone. If the machine is also full of cracked software or other people's downloads, the honest answer is no; an office-issued laptop is the clean solution at that point.
No, and it usually backfires. The proportionate controls are the account rules, the tunnel logs and office-side permissions — all on systems the office owns. Monitoring a family's personal computer is a legal and trust minefield. If the office cannot trust a home PC, the answer is a company laptop, not spyware.