Quick Navigation

Select a security setting to move directly to that section.

• ➜ 1. Keep Microsoft Defender Antivirus Active
• ➜ 2. Keep Microsoft Defender Firewall Enabled
• ➜ 3. Configure Ransomware Protection Carefully
• ➜ 4. Turn On Device Encryption or BitLocker
• ➜ 5. Keep SmartScreen and Reputation-Based Protection On
• ➜ 6. Install Windows and Application Updates
• ➜ 7. Strengthen Sign-In with Windows Hello and MFA
• ➜ 8. Review Privacy and App Permissions
• ➜ 9. Build a Backup You Can Actually Restore
• ➜ 10. Download Software Only from Trusted Sources
• ➜ 11. Enable Find My Device and Protect Physical Access
• ➜ 12. Check Secure Boot, TPM and Memory Integrity
• ➜ Common Security Mistakes
• ➜ Frequently Asked Questions
• ➜ References

Before You Change Anything

Create or locate your BitLocker recovery key, save important work, use an administrator account only when required, and avoid changing settings controlled by an employer or school. Security features work together; switching one off to solve a temporary inconvenience can create a much larger risk.

1. Keep Microsoft Defender Antivirus Active

Microsoft Defender Antivirus is built into Windows and provides real-time protection against malware, spyware, ransomware-related activity, and other threats. Open Windows Security, select Virus & threat protection, then Manage settings. Confirm that Real-time protection, Cloud-delivered protection, and Automatic sample submission are enabled unless your organisation manages them differently. Tamper Protection should also remain on because it makes it harder for malicious software or unauthorised users to change important Defender settings.

Do not run several real-time antivirus products together unless the vendors specifically support that arrangement. Competing security engines can slow the computer and create conflicts. If you install a recognised third-party antivirus, Windows normally adjusts Defender's active status automatically. For most home users, the important lesson is not to switch protection off simply because an application or cracked program asks you to.

2. Keep Microsoft Defender Firewall Enabled

The firewall controls network traffic between your computer and other devices. It helps block unauthorised inbound connections and applies different rules to domain, private, and public network profiles. Open Windows Security, choose Firewall & network protection,n and confirm that the active profile is protected.

A public network, such as hotel or café Wi-Fi, should not be treated like your trusted home network. Avoid disabling the entire firewall to make one application work. Use an approved application rule, confirm the correct network profile, le or ask an administrator to review the blocked connection. Turning off the firewall removes a layer that protects services you may not even realise are listening.

3. Configure Ransomware Protection Carefully

Controlled Folder Access can prevent untrusted applications from changing files in protected locations. In Windows Security, go to Virus & threat protection, open Manage ransomware protection, and review Controlled folder access. When enabled, Windows may block an unfamiliar but legitimate program, so use the approved Allow an app through Controlled folder access option rather than disabling the feature completely.

This setting is an extra layer, not a replacement for backups. Ransomware can affect cloud-synchronised folders, removable drives, shared storage and accounts. Keep at least one protected backup that is not permanently writable from the computer, and test that you can restore files.

4. Turn On Device Encryption or BitLocker

Drive encryption protects information when a laptop is lost, stolen, stolen or removed from your control. Depending on the hardware and Windows edition, you may see Device encryption under Privacy & security or BitLocker Drive Encryption in Control Panel. Before enabling it, make sure the recovery key is stored in a secure location that you can access during a hardware or firmware problem.

Encryption does not stop malware after you sign in, and it does not replace a strong account. Its main strength is protecting data at rest. Business users should follow organisational key-escrow and device-management policies rather than saving recovery information in an informal chat or unprotected document.

5. Keep SmartScreen and Reputation-Based Protection On

Microsoft Defender SmartScreen checks suspicious websites, downloads, and applications. Open Windows Security, select App & browser control, then review Reputation-based protection. Settings may include checking apps and files, SmartScreen for Microsoft Edge, potentially unwanted app blocking, and phishing protection.

A warning should not be treated as an inconvenience to click through automatically. Confirm the website, publisher,r and reason for the download. Files described as activators, key generators, unofficial drivers, rs or cracked versions of paid software are particularly risky because attackers know users expect them to modify security controls.

6. Install Windows and Application Updates

Security updates repair vulnerabilities that attackers can exploit. Open Settings, choose Windows Update, and install available security and quality updates. Restart when required, and also update browsers, productivity tools, PDF readers, communication apps, firmware, and drivers through trusted channels.

Do not download a random driver updater because it promises to make the computer faster. Use Windows Update, the device manufacturer's support page, or an approved enterprise tool. Windows 10 reached the end of standard support on 14 October 2025, so users still relying on it should review Microsoft's supported upgrade or extended-security options instead of assuming normal security fixes will continue indefinitely.

You May Also Like to Read About

Continue strengthening your devices and online accounts with these related TechKnow Solution guides.

• How to Make Your Android Phone Last More Than Five Years
• Top 50 Windows interview questions and answers for ICT beginners and support technicians
• How to clear the activate windows notification permanently
• Windows Security Settings Everyone Should Enable
• 50-windows-keyboard-shortcuts-every-user-should-know-to-work-faster
• The future of Windows AI-PCs-Copilot-and-the-next-generation-of-computing

7. Strengthen Sign-In with Windows Hello and MFA

A password alone should not be the only defence for important accounts. Windows Hello supports a PIN and, on compatible devices, fingerprint or facial recognition. The PIN is tied to the device and works with security hardware, which is different from reusing an online password.

Also enable multifactor authentication on the Microsoft account, email, cloud storage, and other sensitive services. Never approve an unexpected sign-in prompt. If prompts appear repeatedly, deny them, change the password from a trusted device,e and review recent account activity.

8. Review Privacy and App Permissions

Go to Settings, select Privacy & security, ty and review access to location, camera, microphone, contacts, calendar, notifications, account information, and other data. Allow only applications that genuinely require the permission. A video-conferencing app may need the microphone; an unknown calculator normally does not.

Remember that desktop applications may not appear or behave exactly like Microsoft Store apps in every permission list. Remove applications you no longer use, examine browser permissions separately,y and review extensions because a browser add-on can read or change far more information than many users expect.

9. Build a Backup You Can Actually Restore

Backups are part of security because prevention sometimes fails. Use OneDrive or another reputable cloud service for convenient file protection, but do not depend on synchronisation alone. A damaged, deleted, ed or encrypted file can sometimes cause the problem. Keep an additional versioned or offline copy of irreplaceable data.

A practical approach is the 3-2-1 principle: maintain three copies of important information, on two types of storage, with one copy off-site or otherwise isolated. Test restoration periodically. A backup that has never been restored is an assumption, not a recovery plan.

10. Download Software Only from Trusted Sources

Many Windows infections begin with a user-approved installation. Prefer Microsoft Store, the official developer website, or your organisation's software portal. Check the domain carefully, avoid advertisement download buttons,s and scan unexpected files before opening them.

Do not disable Defender, SmartScreen,n or the firewall because an installer says it is necessary. Be suspicious of pirated applications, game cheats, fake browser updates, remote-support tools sent by strangers, unknown email attachments, and password-protected archives whose password appears in the same message.

11. Enable Find My Device and Protect Physical Access

For a personal Windows device linked to a Microsoft account, Find my device can help locate and remotely lock a missing computer when location services and the feature are enabled. Open Settings, Privacy & security, then Find my device. Confirm that you understand the privacy trade-off and that the Microsoft account itself is strongly protected.

Physical habits still matter. Lock the screen when stepping away, avoid leaving an unlocked laptop in a vehicle, use a standard user account for daily work, where practical,l and do not allow unknown USB devices to be connected simply because someone found them.

12. Check Secure Boot, T,M and Memory Integrity

Modern Windows devices use hardware-backed protections. Secure Boot helps stop untrusted boot components, the Trusted Platform Module supports protected cryptographic operations, and Core isolation with Memory integrity can make it harder for malicious code to interfere with high-security processes.

Open Windows Security and review Device security. Do not change firmware, Secure Boot or TPM settings casually, especially on an encrypted or organisation-managed computer. A poorly planned change can trigger BitLocker recovery or prevent the system from starting. Resolve incompatible drivers through trusted updates before forcing settings.

Common Windows Security Mistakes

• Disabling antivirus or the firewall to install untrusted software.
• Ignoring Windows browser and application updates.
• Reusing one password across email, social media , and cloud accounts.
• Approving unexpected MFA prompts.
• Downloading cracked software, fake drivers,s or unofficial activators.
• Keeping the only backup permanently connected to the computer.
• Saving BitLocker recovery keys only on the encrypted device.
• Using an administrator account for every daily task.
• Ignoring browser extensions and application permissions.
• Assuming a fast speed test means a computer or network is secure.

Is Microsoft Defender enough for a normal home user?

For many home users, the built-in antivirus, firewall, SmartScreen, updates, and sensible browsing habits provide a strong baseline. A paid security suite may add services such as family controls, identity monitoring or cross-platform management, but paying for antivirus does not replace safe behaviour and backups.

Should I disable the firewall when an application will not connect?

No. Confirm the application, network profile, sserver addressess and required port, then create or request a narrowly scoped rule. Disabling the full firewall exposes unrelated services and hides the real configuration problem.

Does BitLocker slow down a modern laptop?

On compatible modern hardware, the everyday performance impact is generally small. The more important preparation is protecting the recovery key and following guidance before firmware, TPM, or major hardware changes.

Can OneDrive protect me from ransomware?

Version history and recovery features can help, but synchronisation is not a complete ransomware strategy. Maintain another tested backup that ransomware on the computer cannot easily alter.

Why does Windows block a program I trust?

SmartScreen Antivirus or Controlled Folder Access may not recognise the file, may detect risky behaviour, ur or may be applying an organisational policy. Verify the publisher and source, scan the file, and use a specific approved exception only after confirming it is safe.

References and Further Reading

• Microsoft Support — Stay Protected with the Windows Security App
• Microsoft Learn — Microsoft Defender Antivirus in Windows
• Microsoft Learn — Windows 11 Security Features Index
• Microsoft Learn — Virus and Threat Protection
• Microsoft Learn — Configure Controlled Folder Access
• Microsoft Support — Find and Lock a Lost Windows Device
• Microsoft Support — Windows Privacy Settings Used by Apps
• CISA — StopRansomware Guide