How to Harden Windows Without Going Overboard

Most people never harden Windows. They install it, click Next, sign into everything, ignore every warning, and hope nothing bad happens.

That’s security by wishful thinking.

You don’t need to become a cybersecurity expert, turn your PC into a government bunker, or unplug from society like you’re hiding from Skynet. You need a handful of reasonable layers — most of them already built into Windows and just waiting for you to check them.

Prefer to watch instead of read? Here’s the full walkthrough — or skip it and keep reading below.

Step 1: Keep Windows Updated

Yes, I know. That one hurt a little.

Windows Update can be annoying, sometimes it breaks things, and it loves rebooting at 2:37 PM because apparently that’s a great time for personal growth. But skipping updates forever isn’t security. Keep Windows, your browsers, and your drivers reasonably current — and stop clicking “remind me later” for six months hoping the update gets bored and leaves.

Step 2: Let Windows Security Do Its Job

Open Windows Security from the Start menu and go to Virus & threat protection → Manage settings. Make sure these are all On:

• Real-time protection
• Cloud-delivered protection
• Tamper Protection

For most home users, Microsoft Defender is good enough — if you actually let it work. If you prefer a paid security suite, that’s fine too, but run one primary antivirus. Two real-time antivirus programs fight each other harder than Windows Update fights the update it just downloaded.

Step 3: Consider Ransomware Protection

Still in Windows Security, go to Virus & threat protection → Ransomware protection → Manage ransomware protection and look at Controlled folder access.

It’s like a security guard standing in front of your Documents folder asking, “And who exactly are you?” If an unknown program tries to change protected files, Windows blocks it.

Fair warning: it can also block legitimate programs until you allow them. That doesn’t make it bad. It means security occasionally makes you prove you meant to do something. Annoying? Yes. Useful? Also yes.

Step 4: Check Device Security

In Windows Security, open Device security → Core isolation details and look at Memory integrity. If your PC supports it and turning it on doesn’t cause driver problems, it’s a good layer — it helps protect the core of Windows from being tampered with.

While you’re there, check whether Secure Boot is on. If your PC supports it, it should be.

One rule before you touch any firmware settings: if BitLocker or device encryption is on, have your recovery key in hand first. Changing firmware settings is a classic way to trigger the recovery screen.

Step 5: Save Your BitLocker Recovery Key

BitLocker protects your data if the computer is stolen — especially important for laptops. But if Windows ever asks for the recovery key and you don’t have it, you may be locked out of your own files.

Don’t settle for “I think it’s in my Microsoft account.” Actually check: sign in at aka.ms/myrecoverykey from another device, find the key, and print it or store it in your password manager. The worst time to go looking for it is when your computer is glaring at you like a digital bouncer. (More on this in Don’t Reset Your PC Until You Do These 7 Things First.)

Step 6: Stop Using an Administrator Account for Everything

The first account Windows creates is an administrator, and most people use it forever. That means when you make a mistake, the mistake gets admin rights too.

Create a separate standard account for everyday use (Settings → Accounts → Other users), and keep the admin account for installing software and making system changes. Slightly less convenient? Sure. So is locking your front door.

Step 7: Remove Software You Don’t Use

Hardening isn’t only turning things on. It’s also taking junk out. Old printer utilities, random driver updaters, leftover antivirus trials, coupon extensions — if you don’t use it, uninstall it (Settings → Apps → Installed apps). Every extra program is one more thing that can break, nag, spy, or be exploited.

Browser extensions count too. If you have nineteen of them installed, your browser isn’t customized. It’s a flea market with internet access.

Step 8: Use a Password Manager and Two-Step Sign-In

Use long, unique passwords for every important account, stored in a real password manager — not reused, and not in a notebook labeled “passwords.” Then turn on multi-factor authentication for your email, Microsoft account, banking, and anything tied to money or identity.

Your email is the master key to everything else. If someone gets in, they can reset the rest. Protect it like it matters, because it does.

Step 9: Don’t Forget the Router

Your PC sits behind your router, so the router is part of your security whether you like it or not. Change its admin password, update its firmware, use WPA2 or WPA3, and turn off WPS. The full walkthrough is here: Lock Down Your Home Wi-Fi and Router.

Step 10: Backups Are Security

Backups aren’t optional and they’re not “someday.” They’re what turn a disaster into an inconvenience.

Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy somewhere other than your house. And don’t leave your backup drive plugged in all the time — if ransomware can reach it, it can encrypt it too. Back up, disconnect, put it somewhere safe.

Also: OneDrive, Google Drive, and Dropbox are sync, not backup. If ransomware scrambles your files and those changes sync, congratulations — you now have synchronized sadness.

What Not to Do

• Don’t run “debloat” scripts or registry hacks from strangers unless you understand what they change.
• Don’t disable security features because a forum post from 2017 said it gets you three more frames per second.
• Don’t install cracked software. That’s not saving money; it’s inviting malware in and offering it snacks.
• Don’t ignore browser warnings, and don’t reuse passwords.

The Short Version

1. Keep Windows and your browsers updated.
2. Turn on real-time, cloud-delivered, and Tamper Protection.
3. Consider Controlled folder access.
4. Check Memory integrity and Secure Boot.
5. Save your BitLocker recovery key before touching firmware.
6. Use a standard account for daily work.
7. Remove software and extensions you don’t use.
8. Use a password manager and two-step sign-in.
9. Lock down your router.
10. Keep backups — with one disconnected.

You don’t have to make Windows impossible to use. You just have to stop leaving every door open and acting surprised when something walks in.

Stay grumpy.