Windows Security Hub

For most users, Microsoft Defender is enough when correctly configured. Turn on SmartScreen in Windows and your browsers, enable Controlled Folder Access and Attack Surface Reduction (ASR) rules (when available), and keep Windows and apps updated. Combine this with least‑privilege (daily use as a standard user) and good browsing habits. Running two real‑time AVs can cause conflicts—avoid it.

Windows 11 Home often supports Device Encryption if your hardware meets requirements (TPM 2.0, Modern Standby, etc.). Full BitLocker management is included with Pro/Enterprise/Education. If you don’t see either option, consider a reputable full‑disk encryption tool or upgrading to Pro. Always back up your recovery keys securely (cloud account, printed copy in a safe place).

No—use a standard account for daily work. Keep a separate admin account for software installs and system changes. This reduces accidental damage and blocks many malware actions that require admin privileges. When prompted for admin credentials, pause and confirm the action is intentional.

Prefer the Microsoft Store or the vendor’s official download page. Avoid “free crack” sites and random aggregators. For critical tools, verify the digital signature (right‑click > Properties > Digital Signatures) or check the SHA‑256 hash the vendor publishes. On first run, review permissions, disable unnecessary auto‑start, and keep installers you trust (so you can re‑install from a known clean copy).

Passkeys replace passwords with phishing‑resistant cryptography. Your passkeys can sync via your platform’s secure cloud (Microsoft/Apple/Google) or live on hardware security keys (FIDO2). Tip: enable passkey sync for convenience and also enroll a second authenticator (another device or hardware key) as backup so you’re never locked out.

Create a child account (standard, not admin). Turn on Microsoft Family Safety to manage screen time, web/content filters, and app purchases. Enable SmartScreen and strong browser protections. Discuss safe‑click habits, why not to bypass prompts, and how to ask an adult before installing apps or sharing personal info.

Use both. Follow 3‑2‑1: keep 3 copies (original + 2 backups), on 2 media types (e.g., external drive and cloud), with 1 offsite (cloud). Cloud handles disaster/theft; local gives fast restores. Schedule backups and test restoring a file periodically so you know it works before you need it.

Run Windows Defender Offline Scan. In Device Manager, remove unknown devices/drivers (right‑click > Uninstall). Use Sysinternals Autoruns to inspect startup items (Logon, Services, Scheduled Tasks) and disable suspicious entries. Review installed programs, browser extensions, Remote Desktop settings, and PowerShell execution policy.

Yes, if you have Pro/Enterprise with virtualization enabled. Sandbox is a throwaway VM for testing untrusted files, installers, or websites. Close Sandbox and all changes vanish. It’s great for curiosity testing without risking your main system.

If BitLocker/Device Encryption was enabled, your data at rest is protected. Immediately sign out of accounts remotely (Microsoft, email, banks), revoke sessions/tokens, change passwords, and enable alerts. If available, trigger a remote lock/wipe. Monitor for suspicious activity and contact your provider if you suspect account compromise.

Enforce device encryption, standard users, MFA/passkeys, and Defender baselines. Centralize updates (Windows Update for Business/Intune) and backups. Document incident response and recovery steps, then test them. Train staff on phishing and safe‑install practices. Start with your high‑risk accounts (email, finance) and high‑value devices (laptops with customer data).