How to Harden Windows 11: A Security Checklist

To harden Windows 11, keep it updated, sign in with a standard account for daily use, keep Microsoft Defender, Tamper Protection, and SmartScreen on, turn on Memory integrity and device encryption (or BitLocker), and protect your sign-in with Windows Hello or a passkey. Those steps block most common attacks without any extra software.

This guide is for home users and small offices. Work PCs managed by an IT department may already enforce these settings.

Quick Answer

Update Windows, use a standard account, turn on Memory integrity and encryption, keep Defender and SmartScreen on, and back up your files.

Hardening Checklist

Step	Where	Protects against
Install updates	Settings > Windows Update	Known security holes
Use a standard account	Settings > Accounts > Other users	Malware gaining admin rights
Memory integrity	Windows Security > Device security > Core isolation	Malicious drivers and kernel attacks
Device encryption or BitLocker	Settings > Privacy & security	Data theft from a lost or stolen PC
Tamper Protection	Windows Security > Virus & threat protection settings	Malware turning off Defender
SmartScreen and Smart App Control	Windows Security > App & browser control	Dangerous downloads and apps
Windows Hello or passkeys	Settings > Accounts > Sign-in options	Password theft and phishing
Backups	Windows Backup, File History, or an external drive	Ransomware and drive failure

Step 1: Keep Windows and Apps Updated

1. Open Settings > Windows Update and select Check for updates.
2. Turn on Get the latest updates as soon as they’re available if you want fixes sooner.
3. Update your browser and other apps too. In the Microsoft Store, open Library and select Get updates.

Pause updates only briefly; our guide to pausing Windows Update explains the safe way.

Step 2: Use a Standard Account Day to Day

1. Go to Settings > Accounts > Other users and select Add account.
2. Create an account for daily use and leave it as a Standard User.
3. Keep your current account as the administrator and use it only when Windows asks for admin approval.

Step 3: Turn On Memory Integrity

1. Search for Core isolation and open it (it’s in Windows Security under Device security).
2. Turn on Memory integrity and restart.
3. If Windows lists incompatible drivers, update or remove them, then try again.

Step 4: Encrypt the Drive

1. Open Settings > Privacy & security > Device encryption. On Pro editions, you may see BitLocker drive encryption instead.
2. Turn it on.
3. Save the recovery key somewhere safe. Here’s how to find your BitLocker recovery key later.

Step 5: Keep Defender’s Protections On

1. Open Windows Security > Virus & threat protection > Manage settings.
2. Make sure Real-time protection, Cloud-delivered protection, and Tamper Protection are on.
3. Consider turning on Controlled folder access under Ransomware protection. Allow trusted apps if it blocks them.
4. In App & browser control, keep reputation-based protection on. Smart App Control blocks untrusted apps; on many PCs it’s only available after a clean install.

Step 6: Secure Sign-In and Network

• Set up Windows Hello (PIN, face, or fingerprint) in Settings > Accounts > Sign-in options.
• Turn on two-step verification for your Microsoft account and email.
• Keep the firewall on for all network profiles, and set public Wi-Fi to Public network.
• Turn off Remote Desktop in Settings > System > Remote Desktop if you don’t use it, and close unused ports; see how to close ports on Windows.
• Check that Secure Boot is enabled in your firmware.

Step 7: Back Up

Use Windows Backup or copy important files to an external drive that you disconnect afterward. An offline copy is your best defense against ransomware.

Old or unused admin accounts are a risk too. Here’s how to remove an administrator account or change it to standard.

Get in the habit of locking your screen whenever you step away.

Troubleshooting

• Memory integrity won’t turn on: Select Review incompatible drivers, then update or uninstall those drivers.
• An app stops working after hardening: Check Protection history in Windows Security and allow the app if you trust it.
• Device encryption is missing: Your hardware may not support it, or you’re signed in with a local account. Pro editions can use BitLocker.

Frequently Asked Questions

Do I need third-party antivirus?

Not for most people. Microsoft Defender with these settings gives strong protection.

Will hardening slow my PC down?

Memory integrity can reduce performance slightly on older PCs. The other steps have little effect.

Summary

1. Update Windows and apps.
2. Use a standard account daily.
3. Turn on Memory integrity and encryption.
4. Keep Defender, Tamper Protection, and SmartScreen on.
5. Use Windows Hello and back up offline.