Overview
A new or freshly installed Windows 11 PC is reasonably secure by default, but a few changes make it much safer and more private. This guide is a practical checklist of the most important security and privacy settings to enable.
Hardening a few Windows 11 settings greatly improves security and privacy.
Key Takeaways
- Keep Windows updated and enable BitLocker, the firewall, and Defender.
- Turn on modern protections: Core Isolation, Reputation-based protection, and Controlled Folder Access.
- Use Windows Hello and a standard (non-admin) account for daily use.
- Review privacy permissions and set up backups and Find My Device.
Essentials First
- Install the latest Windows updates (Settings > Windows Update).
- Enable BitLocker drive encryption to protect data if the device is lost or stolen.
- Confirm Microsoft Defender Firewall is on (Windows Security > Firewall & network protection).
- Run a full malware scan in Windows Security > Virus & threat protection.
Enable Modern Defender Protections
- Smart App Control — blocks untrusted apps (available on clean installs).
- Core Isolation / Memory Integrity — Windows Security > Device security > Core isolation.
- Reputation-based protection — Windows Security > App & browser control (blocks malicious apps/downloads).
- Controlled Folder Access — protects your folders from ransomware (Ransomware protection).
Sign-In and Accounts
- Set up Windows Hello (PIN, fingerprint, or face) for secure, fast sign-in.
- Enable Dynamic Lock to lock the PC when your paired phone leaves range.
- Use a standard user account for daily work, keeping an admin account separate.
Privacy Settings
1. Open Settings > Privacy & security.
2. Review App permissions (camera, microphone, location) and disable access for apps that do not need it.
3. Adjust diagnostic data and advertising ID settings to your comfort level.
4. Turn off unnecessary background access.
Reduce Your Attack Surface
- Disable Remote Desktop unless you actually use it (Settings > System > Remote Desktop).
- Enable Find My Device to locate or lock a lost laptop.
- Set up backups (File History/OneDrive) and create System Restore points.
- Use Windows Sandbox (Pro/Enterprise) to run risky apps in isolation.
Troubleshooting
Problem: Smart App Control is greyed out.
Solution: It can only be enabled on a clean install and may be in evaluation mode. A reset/clean install is required to turn it on later.
Problem: BitLocker is not available.
Solution: BitLocker needs Windows Pro/Enterprise and TPM. On Home, use Device Encryption if supported, or upgrade the edition.
Problem: Core Isolation will not turn on.
Solution: An incompatible driver may block Memory Integrity. Update or remove the flagged driver, then enable it.
Problem: An app stopped working after enabling protections.
Solution: Add a trusted app as an exception (e.g. in Controlled Folder Access) rather than disabling the protection entirely.
Conclusion
Spend a few minutes hardening Windows 11: keep it updated, enable encryption and the modern Defender protections, use Windows Hello and a standard account, and review privacy permissions. These changes dramatically improve your security and privacy.
</w:pBdr><w:spacing w:before="220" w:after="40"/></w:pPr><w:r><w:rPr><w:b/><w:bCs/><w:color w:val="0B5394"/><w:sz w:val="21"/><w:szCs w:val="21"/><w:rFonts w:ascii="Calibri" w:cs="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri"/></w:rPr><w:t xml:space="preserve">About TechHub
This guide is part of the TechHub Knowledge Base. For more step-by-step IT guides and support, visit techhub.com.lk.
