5 Windows Security Settings You Should Never Skip Over

In 2025, Microsoft claimed to have the world's "most widely used operating system" with over 1.4 billion active devices per month. This dominant market share means it's a target for many malicious actors who invest time and resources into trying to exploit security vulnerabilities. However, Microsoft has implemented various settings that allow you to protect yourself.

With a little know-how, you can keep yourself protected on Windows without downloading any third-party software. Windows has a wide range of secure authentication methods for accessing your device, a firewall, an antivirus, and even a way to encrypt your drives and locate your device if it gets lost or stolen. 

So, if you have been using Windows for a while and any of the security settings mentioned below sound new to you, it's essential that you start using them right away. Since the official support for Windows 10 ended in October 2025, this guide will focus on Windows 11.

If you're looking for an easier and more secure way to log into your Windows PC, you need to enable Windows Hello. Once you do, you no longer need to use a password to unlock your Windows device. Instead, you can use a PIN or biometrics (facial recognition or fingerprint recognition). These methods are more convenient and, in the case of biometrics, cannot be forgotten or guessed. PINs are easier to remember and are actually safer than passwords for on-device authentication.

To enable Windows Hello, follow the steps below:

1. Go to Settings > Accounts > Sign-in options.

2. Click either Facial recognition, Fingerprint recognition, or PIN.

3. Click Set up.

4. Follow the instructions to set everything up.

5. In the Additional settings section, toggle on "For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device."

The beauty about the PIN in particular is that once you link your Microsoft account (more on this later) to the Windows PC, you can use it to reset your Hello PIN if necessary. If you're using a local account, you will first need to sign in with your password when you forget your PIN and then reset it. 

If you're a heavy internet user, then a firewall is an essential security tool that cannot be skipped. That's because not all the traffic coming through the internet, or network you're connected to, is of good intentions. Some of it is unsolicited, such as hackers trying to breach your device by remotely injecting malicious code. Your PC needs a way to stop what is coming with bad intentions, so it can prevent it from causing harm. That is where a firewall comes in, since it knows what to flag or reject as suspicious traffic attempting to access your system. 

Windows has a built-in firewall. Here's how you can enable it:

1. Go to Settings > Privacy & security > Windows Security > Firewall & network protection. 

2. Click Public network.

3. Toggle on Microsoft Defender Firewall.

4. Click the back arrow in the top left corner.

5. Repeat steps two and three for Domain network and Private network.

Firewalls are not enough when it comes to protecting your Windows PC from online threats — you also need an antivirus. Microsoft Defender is one of the best antivirus apps out there, and it comes built into Windows. You just need to ensure that it has some of the important features turned on. One is Real-time protection, which constantly monitors your PC for malware.

To enable Real-time protection, do the following:

1. Go to Settings > Privacy & security > Windows Security > Virus & threat protection.

2. Under Virus & threat protection settings, click Manage settings.

3. Toggle on Real-time protection.

You also need to enable Controlled folder access, which only allows apps that Windows trusts to make changes to protected folders. To enable it, do the following:

1. Go to Settings > Privacy & security > Windows Security > Virus & threat protection.

2. Under Ransomware protection, click Manage ransomware protection.

3. Toggle on Controlled folder access.

4. Click Protected folders.

5. Click Add a protected folder.

6. Navigate to the folder you want to protect and add it.

7. Repeat steps five and six until you've added all the folders you want controlled access to.

Core isolation is another feature that helps by isolating the code that apps run. It first runs it in a virtual environment to determine software is safe before allowing Windows to run it.

1. Go to Settings > Privacy & security > Windows Security > Device security.

2. Under Core isolation, click Core isolation details.

3. Toggle on Memory integrity.

4. Toggle on Local Security Authority protection as well.

When setting up Windows, you're required to link your Microsoft account to it. However, if you're one of the people who managed to circumvent this requirement, now might be the time to consider using that Microsoft account after all. Beyond the benefits of using a Microsoft account, such as cross-device syncing, moving your Windows license when upgrading device, and purchasing apps and movies from the Microsoft Store, it also allows you to take advantage of Microsoft's multi-factor authentication, authentication apps, passkeys, passwordless sign-in, security keys, recovery methods, and more.

If you don't have a Microsoft account yet, go to the Microsoft website and create one. Afterward, follow these steps below to link it to your Windows device.

1. Go to Settings > Accounts > Your info.

2. Under Account settings, click Sign in with a Microsoft account instead.

3. Follow the instructions to sign in to your Microsoft account.

Microsoft will be collecting data about your activity on your Windows computer, but there are ways to limit the amount of data it collects. 

One of the security features requiring a Microsoft account is Device Encryption. This enables BitLocker encryption for your drives, and is essential if you store sensitive information on your computer. If a thief steals your device, it means that they won't be able to access your information even when they put your drive in another computer. 

When enabled, Device Encryption stores a recovery key in your Microsoft account. Although it's usually turned on automatically, if you need to activate it manually, go to Settings > Privacy & security > Device encryption and switch the toggle on.

If your computer is ever stolen, another useful security feature of your Microsoft account can locate it for you. To enable Find My Device for your Windows PC, follow these steps:

1. Go to Settings > Privacy & security > Location.

2. Toggle on Location services.

3. Go back and click the Find my device page.

4. Toggle on Find my device.

Here's how to use Find My Device to locate or lock your Windows computer in case it's ever stolen:

1. Log in to your Microsoft account in a web browser.

2. Click Devices in the left-side menu.

3. Under your PC's name, click Find my device.

4. A map will open up, showing you the last known location of your device.

5. To lock it, click Lock.

6. Enter the message you want to show on the lock screen.

7. Click Lock.