4 Windows Security Settings to Turn On Right Now

If you think your Windows PC is secure, it might not be. Some of the most important security settings in Windows can be switched off, and you’d never know. No alert. No warning. No protection.

That’s exactly what malware counts on.

Here are four settings I check on every Windows PC. They’re all built in, they’re all free, and most people never look at them.

Prefer to watch instead of read? Here’s the full video — or skip it and keep reading below.

1. Tamper Protection

Go to Start → Settings → Privacy & security → Windows Security → Virus & threat protection. Under Virus & threat protection settings, click Manage settings, and make sure Tamper Protection is On.

Why it matters: most people think their antivirus protects them. But malware doesn’t usually fight your antivirus. It disables it first. Once Microsoft Defender is off, there’s no scanning, no alerts and no protection, and your system is effectively blind.

Tamper Protection locks your security settings so they can’t be quietly changed. It helps stop real-time protection being switched off, security services being stopped, and Registry changes or scripts that try to weaken protection in the background.

I’ve seen systems where everything looked completely normal, with no warnings and no pop-ups, but Defender had already been disabled. By the time the user noticed, the system was already compromised. Turn it on. Leave it on. Don’t touch it again.

Note: if you use a different antivirus product, some of these Defender settings may be managed by it instead.

2. Reputation-Based Protection (SmartScreen)

Most infections don’t come from hackers breaking in. They come from someone clicking something they shouldn’t: a free download, a fake update, a bundled installer. Next, Next, Next, Done, and now your system is full of garbage.

Go to Windows Security → App & browser control → Reputation-based protection settings and turn on:

• Check apps and files
• SmartScreen for Microsoft Edge
• Phishing protection
• Potentially unwanted app blocking (tick both Block apps and Block downloads)

These use Microsoft’s reputation information to warn you about unknown or low-reputation downloads, block known malicious files and stop phishing sites from stealing your passwords. That’s prevention before anything runs.

Potentially unwanted app blocking deserves special mention. It goes after browser hijackers, toolbars, bundled junk and hidden crypto miners: stuff that won’t always count as a “virus” but absolutely wrecks your PC.

Windows does a decent job here, but it’s not perfect. Microsoft Defender is good enough for most people. If you want a paid option with a stronger safety net, the one I recommend is Bitdefender (affiliate link: if you buy through it, I earn a commission at no extra cost to you). Just run one real-time antivirus, not two.

3. User Account Control (UAC)

Click Start, type UAC, and open Change User Account Control settings. The slider should be at the default (second from the top) or higher.

UAC is your last warning before something changes your system. When something tries to install software, modify system files or change the Registry, UAC steps in and asks for permission. If you weren’t expecting that prompt, that’s your red flag.

With UAC turned off, everything runs with full privileges: no prompts, no warnings, no resistance. That’s exactly what malware wants. Leave it on, don’t lower it, and pay attention when it appears. (Even better: use a standard account for everyday work. I explain why in How to Harden Windows Without Going Overboard.)

4. Drive Encryption (Device Encryption or BitLocker)

If your laptop is lost or stolen, the hardware isn’t the real target. Your data is. Without encryption, someone can pull the drive, plug it into another computer and read your files directly. No password required.

• Windows Home: go to Settings → Privacy & security → Device encryption and make sure it’s On. (If you don’t see this section, your PC may not support it.)
• Windows Pro: open Control Panel → System and Security → BitLocker Drive Encryption and check that your system drive is encrypted.

With encryption on, the data is unreadable without your sign-in or recovery key. I’ve seen stolen laptops where the only reason nothing was compromised was that BitLocker was on.

Critical: save your recovery key. Changes to hardware, the BIOS or the TPM can make Windows ask for it, and without it you can be locked out of your own files. Keep a copy somewhere other than the PC: in your Microsoft account, on a USB drive and on paper. Encryption with no recovery key isn’t security. It’s a very secure way to lose everything.

Check These Again Later

Settings like these can be changed by updates, by other security software or by something you install. Put a reminder in your calendar and check all four every few months. It takes five minutes.

The Short Version

1. Turn on Tamper Protection so malware can’t quietly switch off Defender.
2. Turn on all the Reputation-based protection settings, including potentially unwanted app blocking.
3. Keep UAC at the default level or higher, and read the prompts.
4. Turn on Device encryption or BitLocker, and save your recovery key somewhere off the PC.
5. Recheck all four every few months.

Stay grumpy.