Top 24 Security Settings to Adjust on Windows 11 for Enhanced Protection (2025)

UPDATED 2/20/2025: Windows 11 is heralded as the most secure version of Microsoft’s operating system. However, you can further boost your device’s security with several custom configurations and best practices tailored for 2025.

Among the best security practices are routine system updates, virus scans, and the configuration of essential security features such as ransomware protection, phishing shields, firewalls, biometric authentication, and sophisticated controls like Smart App Control and Core Isolation.

For moments when you need to access potentially unsafe websites, the Microsoft Defender Application Guard enables a secure browsing environment. Additionally, Windows Sandbox allows for the installation and testing of applications from untrusted sources without endangering your primary system.

This guide explores an array of optimal security settings for Windows 11 in 2025.

Best Security Settings for Windows 11 in 2025

As you explore the following settings, remember to implement the configurations that best meet your individual needs and circumstances:

1. Keep Your System Updated

Regularly installing system updates is crucial for maintaining device security, as these updates address bugs, strengthen security protocols, and enhance performance.

To manually install updates on Windows 11, follow these steps:

Open the Settings app.
Select Windows Update.
Click the Check for updates button.
(Optional) Toggle the switch for “Get the latest updates as soon as they’re available”.
If prompted, click “Download and install”.
Click the Restart now button to complete the update.

After following these steps, any available updates will automatically download and install on your Windows 11 device.

2. Conduct Regular Virus Scans

Equipped with Microsoft Defender Antivirus, Windows 11 can effectively detect and eliminate various forms of malware, including ransomware and spyware. If you suspect a breach, performing a full or offline scan is essential.

How to Perform a Full Virus Scan:

Open the Start menu.
Search for and launch Windows Security.
Select Virus & threat protection.
Under “Current threats, ”click on Scan options.
Choose the Full scan option to scan your entire system.
Click Scan now.

Microsoft Defender will initiate a scan for malware on your system. Should any threats be detected, the software will either eliminate them or quarantine them based on severity.

How to Run an Offline Virus Scan:

Open Windows Security again.
Navigate to Virus & threat protection.
Select Scan options.
Check the Microsoft Defender Offline scan option.
Click Scan now.
Confirm the scan initiation.

The computer will reboot into recovery mode to conduct the offline scan, ensuring a thorough check for threats.

Enable Periodic Scanning:

To enhance security even with third-party antivirus software, enabling periodic scanning allows Windows Defender to conduct scans for threats that may be overlooked.

Open Windows Security.
Select Virus & threat protection.
Navigate to Microsoft Defender Antivirus options.
Turn on Periodic scanning.

By enabling this feature, periodic scans will run at optimal times, balancing performance with security.

3. Activate Ransomware Protection

Controlled Folder Access in Windows 11 serves as a crucial defense against ransomware attacks, monitoring applications that modify files in protected folders. If a blacklisted application tries to make changes, you’ll receive a warning.

Open Windows Security.
Go to Virus & threat protection.
Select Manage ransomware protection.
Toggle the Controlled folder access switch to activate.

Once implemented, Microsoft Defender will monitor the specified folders and notify you of any unauthorized attempts to access your files. You can customize what applications are allowed to access these folders.

4. Implement Phishing Protection

Enhanced Phishing Protection uses Microsoft Defender SmartScreen to alert users about risky sites and apps, safeguarding sensitive information such as passwords. This feature performs the following actions:

Untrusted Site Warnings: Notifies you when entering passwords on suspicious websites.
Plain Text Password Alerts: Warns you about storing passwords in plain text.
Password Reuse Notifications: Cautions against using the same passwords across different accounts.

For users needing password security, this feature works only when passwords are being used, meaning if you’re leveraging Windows Hello, this may need adjustments.

Access Settings.
Go to Accounts.
Navigate to Sign-in options.
Disable “For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device”.
Remove any active Windows Hello options (facial recognition, fingerprint, etc.).

After following the above steps, you will receive phishing warnings while browsing, enhancing your password security.

5. Create Passkeys for Enhanced Security

Passkeys provide a secure alternative to traditional passwords, leveraging public key cryptography for authentication. This technology significantly reduces the chance of unauthorized account access.

To set up a passkey, navigate to the account security settings of a service supporting this feature:

Open Microsoft Edge or Google Chrome.
Access your Google Account.
Head to the account settings.
Enable the “Passkey sign-in” option.
Click “Create a Passkey”.
Follow the prompts to complete the setup.

Once configured, your passkeys sync across all your devices using your Microsoft account, allowing easy access.

6. Review Firewall Settings

The Microsoft Defender Firewall is a vital feature in controlling network traffic. Always ensure that it’s enabled to block unauthorized access.

Open Windows Security.
Go to Firewall & network protection.
Select your active network.
Toggle the switch for Microsoft Defender Firewall to enable.

This ensures your device is safeguarded against unauthorized access and potential threats.

7. Enable DNS Over HTTPS (DoH)

To bolster your security and privacy while surfing the web, enable DNS over HTTPS.

This protocol encrypts DNS queries, protecting them from inspection and manipulation. To enable DoH:

Open Settings.
Navigate to Network & internet.
Select Wi-Fi or Ethernet.

Quick note: For Wi-Fi, access connection properties.

Click Edit under the DNS server assignment settings.
Set Manual for DNS settings.
Enable IPv4 and input supported DoH IP addresses (e.g., Cloudflare: 1.1.1.1).
Select On (automatic template) for DNS over HTTPS.
Disable the Fallback to plaintext option.
Click Save.

This will encrypt your DNS traffic, enhancing both security and privacy while browsing.

8. Utilize Windows Hello for Secure Logins

Windows Hello adds an extra security layer by allowing biometric authentication using facial or fingerprint recognition.

Enable Face Recognition:

Open Settings.
Click on Accounts.
Select Sign-in options.
Choose Facial recognition (Windows Hello).
Click on Set up.
Confirm with your current password. Follow on-screen prompts.

Once completed, simply look into the camera to unlock your device.

Enable Fingerprint Recognition:

Open Settings.
Click Accounts.
Select Sign-in options.
Choose Fingerprint recognition.
Click on Set up.
Follow the on-screen instructions to capture your fingerprint.

Biometric sign-in offers quick access while ensuring that your device is secure from unauthorized users.

9. Enable Dynamic Lock

Dynamic Lock secures your device by automatically locking it when an associated Bluetooth device (like your smartphone) is out of range.

Turn on Bluetooth on your peripheral device.
Open Settings on your Windows 11 device.
Select Bluetooth & devices.
Enable Bluetooth on your PC if it’s not already.
Click Add device to pair your device.
Follow the pairing instructions.
Navigate back to Accounts.
Click on Sign-in options.
Under Dynamic lock, enable the setting to allow locking.

This feature ensures that your system remains secure whenever you step away.

10. Manage Unwanted Apps

Windows Security includes a feature called reputation-based protection that prevents harmful apps from running on your system.

Open Windows Security.
Go to App & browser control.
Select Reputation-based protection settings.
Turn on Potentially unwanted app blocking.
Choose options to block apps and downloads.

By enabling this feature, Windows 11 will actively block and warn you about low-reputation applications.

11. Protect Your Data with BitLocker

BitLocker encryption protects your data from unauthorized access by encrypting your entire hard drive, available in the Pro, Enterprise, and Education versions of Windows 11.

How to Enable BitLocker:

Open Settings.
Select Storage.
Click on Advanced storage settings.
Go to Disks & volumes.
Select the drive you want to encrypt.
Click Turn on BitLocker.
Follow the prompts to set up encryption.

Enable encryption for additional drives and USB devices for comprehensive data protection.

12. Activate Smart App Control

Smart App Control prevents the execution of untrustworthy apps by allowing only trusted software with valid certificates, securing your device from unwanted behavior.

Open Windows Security.
Navigate to App & browser control.
Select Smart App Control settings.
Choose the Evaluation option to begin.

This feature assesses apps over time and will enable if they function as expected, providing strong protection against unauthorized applications.

13. Enable Core Isolation

Core Isolation enhances system security by blocking malware from accessing high-security processes in memory. This feature is generally enabled by default in Windows 11.

Search for Windows Security in the Start menu.
Select Device Security.
Click on Core isolation details.
Turn on Memory integrity.
Restart your computer.

Once enabled, this feature provides additional protection against malware attacks targeting memory.

14. Use Microsoft Defender Application Guard

This feature creates a secure, virtualized instance of Microsoft Edge for browsing untrustworthy websites, available in Windows 11 Pro.

To activate this feature:

Open Settings.
Go to System.
Choose Optional features.
Click More Windows features.
Check the Microsoft Defender Application Guard option.
Click OK and restart.

Upon restarting, you can browse untrusted sites without compromising system security.

15. Utilize Windows Sandbox

Windows Sandbox provides a safe environment for testing potentially harmful applications without risking your main system setup.

Launch Settings.
Navigate to System.
Open Optional features.
Click More Windows features.
Check the Windows Sandbox option.
Click OK, then restart.

After restarting, you can run Windows Sandbox from the Start menu to safely test applications.

16. Conduct Full Backups Regularly

Full system backups preserve your data against ransomware attacks, hardware failures, or other catastrophic issues. For peace of mind, you can create a system image backup.

Open Start.
Search for Control Panel.
Click on System and Security.
Go to File History.
Select System Image Backup.
Click Create a system image.
Choose an external drive to save the backup.
Proceed by clicking Next and Start backup.

Regular backups, combined with cloud storage options, help guard against data loss from system failures or attacks.

17. Switch to a Standard User Account

Using a Standard User account, rather than an Administrator account, mitigates risks associated with unintended changes to system settings or installations.

Creating a Local Administrator Account:

Open Start.
Search for Settings.
Click on Accounts.
Navigate to Other users.
Click Add account.
Choose I don’t have this person’s sign-in information.
Select Add a user without a Microsoft account.
Create the account with a name and password.
Proceed to set security questions, then click Next.
Select the account, and click Change account type.
Choose Administrator from the dropdown menu and click OK.

Switch the Existing Account to Standard User:

Sign out of your current account.
Log in to the newly created administrator account.
Open Settings.
Go to Accounts.
Select Other users.
Choose the primary account and click Change account type.
Select Standard User and click OK.

This will enforce security by restricting access and requiring administrator credentials for specific system changes.

18. Disable Remote Desktop

Remote Desktop can expose your system to security risks. If you don’t utilize this feature, it’s best to turn it off.

Open Settings.
Select System.
Go to Remote Desktop.
Turn off the Remote Desktop toggle switch.
Click Confirm.

This step ensures your machine isn’t accessible through potentially vulnerable remote access protocols.

19. Sync Time and Date Automatically

Having the correct date and time settings can prevent security issues, including trouble signing into services due to discrepancies.

Open Settings.
Go to Time & language.
Select Date & time.
Toggle the Set time automatically switch to enable.
Click Sync now under the additional settings.

This step will ensure accurate timekeeping on your device, reducing potential login obstacles.

20. Create a System Restore Point

Creating restore points guards your system against unauthorized changes and allows you to revert to prior states in case of system failures.

Open Start.
Search for Create a restore point.
Select your system drive (usually C) and click Configure.
Turn on System protection.
Click Apply followed by OK.
Click Create to make a restore point.
Name the restore point and click Create.
Click Close when complete.

Creating restore points regularly can help safeguard your system settings and critical files.

21. Disable Windows Recall

Windows Recall takes snapshots of your activity, which raises privacy concerns. If you find this feature unnecessary, consider disabling it.

Open Settings.
Navigate to Privacy & security.
Select Recall & snapshots.
Toggle off Save snapshots.
(Optional) Click to delete existing snapshots.
Confirm deletion by clicking Delete all.

Disabling this feature greatly enhances your privacy and reduces your digital footprint.

22. Use MAC Address Randomization

Randomizing your MAC address enhances privacy by reducing your device’s trackability over Wi-Fi networks.

Open Settings.
Select Network & internet.
Go to Wi-Fi.
Enable the Random hardware addresses option.

Once enabled, your computer will use a random MAC address for each connection, making it more difficult to be traced.

23. Activate Scareware Blocker in Microsoft Edge

The Scareware Blocker uses AI technology to protect against common online scams by identifying patterns often seen in scareware attacks.

Open Microsoft Edge.
Click “Settings and more”.
Navigate to Settings.
Go to Privacy, search, and services.
Click on Security.
Enable Scareware blocker.
Ensure that Microsoft Defender SmartScreen is also enabled.

Enabling these features provides an extra layer of defense against online threats while browsing.

24. Utilize Presence Sensing Features

Presence Sensing improves device security by automatically managing aspects like display dimming or shutting down when a user is away.

Open Settings.
Navigate to System.
Select Power & battery.
Click on Screen, sleep, & hibernate timeouts.
Enable the option to Turn off my screen when I leave.
Configure the distances and timeout durations as needed.

This functionality conserves power while ensuring that your computer remains secure when you step away.

What security settings do you plan to adjust on Windows 11? Share your thoughts and experiences in the comments below!

Update February 20, 2025: This guide has been meticulously revised to ensure accuracy and reflect the latest developments concerning Windows 11 security practices.

Additional Insights

1. How often should I update my Windows 11 system?

It’s recommended to check for updates at least once a month, or enable automatic updates to keep your system secure and optimized continuously.

2. What should I do if Windows Defender detects a threat?

If Windows Defender identifies a threat, follow the prompts to quarantine or remove it. Always run a full system scan after to ensure no residual malware remains.

3. Can I revert changes made by the Smart App Control feature?

While Smart App Control evaluates apps based on behavior, if it restricts an application you trust, you may need to disable it temporarily or adjust its settings for that specific app.

Source & Images