A safer Windows 11: 10 settings to enable today

Installing Windows 11 and clicking "Next" until the desktop appears leaves the machine working, but it doesn't leave it secure. The system ships with Microsoft Defender active and the firewall on — that's the floor, not the ceiling. A good part of the protections that genuinely make a difference against ransomware, data theft and kernel exploits sit switched off, waiting for someone to go into the settings and turn them on by hand. This guide covers 10 concrete changes, with no third-party software required, to close the most common gaps for anyone running Windows 11 with no additional hardening.

Why it's worth reviewing the default settings

Microsoft prioritises compatibility and the first-run experience over maximum security — which makes sense, since locking everything down by default would generate technical support at scale. The practical result is that features like full disk encryption, kernel memory isolation and ransomware protection for specific folders exist in the system, but depend on you knowing they exist and going to the right screen to switch them on. None of the steps below requires advanced knowledge or costs money — just a few minutes navigating the Windows Security app and Settings.

The 10 steps to lock down Windows 11

1. 1. Swap your main account for a standard account. If your day-to-day work runs in an Administrator account, any malicious process you run (even accidentally) inherits that privilege. Under Settings > Accounts > Other users, create or adjust an account of type "Standard user" for daily use, and keep the admin account only for installing software and changing system settings.
2. 2. Enable BitLocker (or Device Encryption). Without disk encryption, all it takes is someone pulling the SSD out of a stolen laptop and reading the files on another machine. On Windows 11 Home, go to Settings > Privacy & security > Device encryption and switch the toggle on. On Pro/Enterprise, search for "Manage BitLocker" in the Start menu. In both cases, save the recovery key somewhere other than the PC — without it, a boot problem turns into total data loss.
3. 3. Turn on Controlled Folder Access. This is Defender's built-in anti-ransomware feature: it blocks unauthorised programs from altering files in protected folders (Documents, Pictures and Desktop by default; you can add others). Open the Windows Security > Virus & threat protection > Manage ransomware protection app and switch the toggle on.
4. 4. Enable Core Isolation with Memory Integrity. This feature uses virtualisation to isolate critical kernel processes, making it harder for a malicious driver or piece of malware to inject code into the core of the system. The path: Windows Security > Device security > Core isolation details > Memory integrity. It requires a restart to apply — and on older PCs with an incompatible driver it can cause conflicts, so test it before an important working session.
5. 5. Configure SmartScreen and app and browser control. SmartScreen blocks downloads and sites recognised as malicious before you even click. Under Windows Security > App & browser control > Reputation-based protection settings, confirm that all three options (apps and files, Microsoft Edge, unrecognised downloads) are set to "Block" or "Warn".
6. 6. Review the firewall, network discovery and Remote Desktop. On a public network (a café, an airport, a hotel), the network profile needs to be marked "Public" to disable file sharing and automatic discovery of other devices. If you don't use Remote Desktop, disable the service; if you do, make sure Network Level Authentication (NLA) is on — without it, an exposed port 3389 is a gift to brute-force attacks.
7. 7. Enable PIN/biometric sign-in and 2FA on the Microsoft account. Windows Hello (a PIN or a fingerprint) already reduces the local attack surface, because the credential is tied to the hardware and never travels as a password. But that doesn't replace protecting the Microsoft account itself — enable two-step verification on it. If you still use only a password plus SMS, it's worth understanding why MFA fatigue manages to beat traditional 2FA and considering a move to passkeys, which eliminate credential phishing at the root.
8. 8. Keep Windows Update automatic — system and drivers. A good share of mass exploitation targets a vulnerability that was patched months ago; the victim simply hadn't updated. Under Settings > Windows Update, turn on "Get the latest updates as soon as they're available" and confirm that Microsoft Defender is set to update its definitions automatically, without waiting for the monthly Patch Tuesday cycle.
9. 9. Audit app permissions. Camera, microphone, location and activity history accumulate permissions granted without much thought over time. Under Settings > Privacy & security > App permissions, review app by app and revoke whatever doesn't make sense — a PDF editor doesn't need camera access.
10. 10. Have a 3-2-1 backup before anything goes wrong. Hardening reduces the chance of an incident; it doesn't eliminate it. Three copies, two different media types, one off-site — that can be an external drive plus a cloud service. Without it, ransomware or a disk failure after step 2 (BitLocker) still means lost data if the backup doesn't exist.

Is Windows 11 secure out of the box?

Not entirely. Microsoft Defender and the firewall come switched on, but central features such as BitLocker, Controlled Folder Access, Core Isolation and Windows Hello stay off until you configure them by hand — and those are precisely the settings that block ransomware, mitigate data theft if the machine is stolen, and get in the way of exploits trying to run code in the kernel.

It's worth noting that not every step applies to every kind of user. Memory Integrity can conflict with an old printer or peripheral driver — if the screen freezes after you enable it, restart in safe mode and switch the feature off until you replace the driver. BitLocker on a disk already in use takes longer than on a new one, because it has to sweep the whole of the occupied space. Neither of those points is a reason to skip the step — only to do them one at a time and confirm nothing broke before moving on to the next.

Hardening doesn't stop at the desktop

If your routine includes administering a server as well as the personal laptop — a VPS, a home lab, a hosted service — the same "close the door that's open by default" principle applies there too. The equivalent of Controlled Folder Access for anyone exposing SSH is reviewing sshd_config; we've already written about the SSH settings that close off most brute-force vectors. And after applying the 10 steps in this post, the natural next level is monitoring: auditing Windows security logs via PowerShell surfaces failed logins and suspicious processes before they turn into an incident.

The underlying lesson is always the same: most attacks against home users exploit no zero-day at all — they exploit a default setting nobody changed. The 10 steps above take less than an hour altogether and cost nothing beyond the time. If you've already applied some of them and still use only a password to get into your online accounts, that's the next hole to close.