Windows 11 security settings checklist: encryption, Defender, Smart App Control and more
Three settings matter most on a Windows 11 PC: automatic updates, device encryption with the recovery key saved somewhere safe, and Microsoft Defender left on. Smart App Control and a standard everyday account close most of the rest.
By the editors of ProtectYour.com Last reviewed 6 min read
Affiliate disclosure: this guide links to Bitdefender. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- Keep Windows Update on, turn on device encryption (and save the recovery key), and leave Microsoft Defender running. That is the core.
- Device encryption turns on by itself when you sign in with a Microsoft account. With a local account it does not, so check.
- Turn on Smart App Control if Windows offers it, and memory integrity under Core isolation.
- Use a standard account day to day and keep the administrator account for installs.
- Windows 10 stopped getting free security updates on October 14, 2025. A PC still on it needs upgrading or replacing.
Before you start
This checklist is for Windows 11 Home and Pro on a personal PC. Paths follow Microsoft's support pages as of October 2026; type the feature name into the Start menu if a menu has moved. A work laptop managed by your employer will have some of these locked, which is normal: leave those to your IT team.
If you are still on Windows 10, start there. It reached end of support on October 14, 2025, and the paid consumer extension of security updates was only ever a stopgap. Check Settings > System > About for your version. Our updates guide covers the options.
1. Windows Update, including drivers and Microsoft products
Go to Settings > Windows Update, install anything waiting and restart. Under Advanced options, turn on Receive updates for other Microsoft products so Office is patched too. Avoid pausing updates for weeks: a paused PC misses fixes for flaws that are already being exploited.
Browsers update themselves, but only on restart. If Chrome, Edge or Firefox shows an update badge, restart the browser. Other apps (PDF readers, Zoom, games launchers) need their own updates; the winget upgrade command or the Microsoft Store library page shows many of them in one place.
2. Device encryption, and where your recovery key is
Encryption means a stolen laptop is a lost laptop, not a lost life. Microsoft says device encryption turns on automatically when you first sign in with a Microsoft account (or a work or school account), and the recovery key is attached to that account. With a local account it does not turn on by itself.
- Go to Settings > Privacy & security > Device encryption and make sure it is on. If the option is missing, your PC may not support it, or you may be signed in as a standard user. Windows Pro also has full BitLocker (search Start for "Manage BitLocker").
- Find your recovery key. It is a 48-digit number Windows asks for after some hardware or firmware changes. If you use a Microsoft account, it is usually stored in that account's recovery keys page. Microsoft Support cannot recreate a lost key.
- Keep a second copy: in Manage BitLocker, choose Back up your recovery key and print it or save it to a USB stick you keep somewhere other than the laptop bag.
Sources: Microsoft: Device encryption in Windows and Back up your BitLocker recovery key.
Do this before you need it
3. Microsoft Defender and the Windows Security app
Search Start for Windows Security. Every tile should show a green tick. Under Virus & threat protection, real-time protection should be on; under Firewall & network protection, the firewall should be on for every network type. Microsoft Defender Antivirus is built in and switches itself off only when you install another antivirus, so you never want two running at once.
In App & browser control > Reputation-based protection, turn on Potentially unwanted app blocking (it blocks bundled adware) and leave SmartScreen on. See Microsoft: Stay protected with the Windows Security app.
4. Smart App Control
Smart App Control blocks apps that Microsoft's cloud service judges malicious, and unsigned apps it cannot vouch for. It is one of the strongest protections against the "download this file" style of attack. Find it in Windows Security > App & browser control > Smart App Control settings.
Microsoft notes it may switch itself off for developers and people who regularly run unusual software, and it is unavailable in S mode or with optional diagnostic data turned off. Older builds needed a clean install to turn it back on; Microsoft says recent updates allow turning it on without one. If it blocks an app you trust, check the developer's site for a signed version before turning the feature off. See Microsoft: Smart App Control FAQ.
5. Core isolation and memory integrity
Go to Windows Security > Device security > Core isolation details and turn on Memory integrity. It uses hardware virtualization to stop malicious drivers from taking over the system. If Windows refuses because of an incompatible driver, Microsoft's advice is to get an updated driver from the device maker, or remove the old device or app that installed it. While you are on that screen, check that the Microsoft Vulnerable Driver Blocklist is on. See Microsoft: Core isolation.
6. A standard account, Windows Hello and passkeys
Most home PCs run everything as an administrator, so anything you click can change the whole system. A better setup is one administrator account you use only to install software, and a standard account for everyday use. Add one in Settings > Accounts > Other users, then change the old account's type. For children, use standard accounts with Microsoft Family Safety (see our parental controls guide).
Under Settings > Accounts > Sign-in options, set up Windows Hello (face, fingerprint or PIN). A Hello PIN is tied to this one PC, so it is safer than typing your Microsoft account password each time. Windows can also store passkeys for websites, protected by Hello. See Microsoft: Manage user accounts in Windows.
7. Backups and Find my device
Ransomware and a dead drive have the same cure: a backup that is not permanently attached. Turn on the Windows Backup app for folders and settings, and keep an occasional copy of important files on an external drive you unplug afterwards. Then turn on Settings > Privacy & security > Find my device, so a lost laptop can be located and locked from account.microsoft.com/devices. It needs a Microsoft account and location turned on. See Microsoft: Find or lock a lost Windows device.
Is Microsoft Defender enough?
For most careful home users with the settings above, yes. Defender scores well in independent lab tests, and our guide to whether free antivirus is enough walks through the evidence. A paid suite earns its place for people who want one subscription across Windows, Mac and Android, stronger web filtering against scam sites, or extra ransomware layers for a family PC that several people use.
Windows 11 settings at a glance
| Setting | Where | Protects against |
|---|---|---|
| Windows Update | Settings > Windows Update | Known flaws |
| Device encryption | Settings > Privacy & security | Stolen laptop |
| Defender, firewall | Windows Security | Malware, network attacks |
| Smart App Control | Windows Security > App & browser control | Malicious downloads |
| Memory integrity | Windows Security > Device security | Malicious drivers |
| Standard account | Settings > Accounts | System-wide damage from one click |
| Find my device | Settings > Privacy & security | Lost laptop |
Skip
Common questions
Is my Windows 11 PC encrypted?
Probably, if you signed in with a Microsoft account during setup: Windows turns on device encryption automatically in that case and saves the recovery key to the account. With a local account it does not. Check Settings > Privacy & security > Device encryption.
Should I turn on Smart App Control?
Yes, if Windows offers it. It blocks apps Microsoft's cloud service judges malicious and unsigned apps it cannot vouch for. Microsoft may turn it off automatically for developers, and it is unavailable in S mode or with optional diagnostic data off.
Is Microsoft Defender good enough for Windows 11?
For most home users who keep Windows updated and turn on the built-in protections, yes. A paid suite adds most for families who want one subscription across several platforms or stronger web filtering against scam sites.
What happens if I lose my BitLocker recovery key?
If Windows asks for the 48-digit recovery key and you cannot find it, the data on the drive cannot be recovered, and Microsoft Support cannot recreate the key. Check your Microsoft account's recovery keys page and keep a printed copy.
Your next step
If you want a paid toolAffiliate link
Bitdefender
Best for: Windows, Mac and Android users who want web protection, ransomware layers and several devices covered by one subscription.
Not for: Windows users happy with Microsoft Defender, and iPhone users: iOS apps cannot scan other apps, so the benefit there is mostly web filtering.
Visit BitdefenderRelated guides
- Mac security settings checklist: FileVault, firewall, updates and the restThree settings protect a Mac most: automatic updates, FileVault, and Gatekeeper left at its default so only App Store and identified developers' apps open. The firewall, login items and Find My take five more minutes.
- Is free antivirus enough? What Microsoft Defender covers and what paid suites addWindows already ships with a capable antivirus. Paid suites add extras that matter to some households and not at all to others. This guide helps you tell which one you are.
- Why software updates matter, and how to turn them on for every device you ownInstalling updates is the single cheapest security habit there is. Switch on automatic updates everywhere, know when a device stops getting them, and replace it before that happens.
- How to protect your home Wi-Fi: the router settings that matterA home network is only as secure as the router at the middle of it. Twenty minutes in its settings fixes most of the risk, and a few popular tips are not worth your time.