Windows security: How to protect your home and small business PCs

When it comes to digital security at home and in your small business, you’re on your own. Large businesses typically have dedicated IT staff tasked with ensuring the security of a corporate network and preventing outsiders from stealing data or planting ransomware. You have … yourself.

The worst time to start thinking about security for the PCs on your network is after you’ve experienced a catastrophic incident. The best time is right now, which is why we’ve assembled this guide.

Following the steps I lay out here should help you understand which security issues are most important and, based on that knowledge, establish a security baseline. This isn’t a set-it-and-forget-it task, unfortunately. Online attackers are determined, and the threat landscape is constantly evolving. Maintaining effective security requires continued vigilance and ongoing effort.

Does that sound overwhelming? Maintaining effective security shouldn’t take an excessive amount of time. Spend a few minutes each week reviewing Windows Security to ensure that no red or yellow indicators have appeared, and do a more comprehensive review each month after the Patch Tuesday updates.  

In this guide, I cover more than just the Windows device itself, because many of the threats come from outside. To stay secure, you need to pay close attention to network traffic, email accounts, authentication mechanisms, and unsophisticated users.

This article focuses primarily on the needs of PC owners managing Windows PCs in a home or small business environment, without full-time IT staff. For installations where you’re required to connect to a business network, you’ll need to coordinate your personal security configuration with corporate policies. In some cases, device management policies will prevent you from adjusting some settings.

Also: How to lock down your Microsoft account and guard it from attackers

I’ve also provided guidance to help you understand the differences between Windows 10 and Windows 11, as well as the different editions available for both operating systems (Home, Pro, Enterprise, Education). We know there are still lots of PCs running Windows 10 out there, many of which don’t meet the system requirements to upgrade to Windows 11.

Before you touch a single Windows setting, though, take some time for a threat assessment. In particular, be aware of your legal and regulatory responsibilities in the event of a data breach or other security-related event. Even small businesses can be subject to compliance requirements; if that applies to you, consider hiring a specialist who knows your industry and can ensure that your systems meet all applicable requirements.

Before you begin, though, it’s important to understand the different types of Windows updates and how they work.

• Quality updates are delivered monthly through Windows Update on the second Tuesday of each month. They address security and reliability issues and do not include new features. (These updates also include patches for microcode flaws in Intel processors.) For particularly severe security issues, Microsoft might choose to release an out-of-band update that is not tied to the normal monthly schedule. 

All quality updates are cumulative, so you no longer have to download dozens or even hundreds of updates after performing a clean install of Windows. Instead, you can install the latest cumulative update and you will be completely up to date.

• Feature updates are the equivalent of what used to be called version upgrades. They include new features and require a multi-gigabyte download and a full setup. Windows 10, which is rapidly nearing its end-of-support deadline, no longer receives feature updates. For Windows 11, Microsoft’s current policy is to release one feature update per year, in the second half of the year. Feature updates are delivered through Windows Update and are not installed automatically unless the current version has reached the end of its support lifecycle.

Also: The best all-in-one computers you can buy

By default, modern Windows devices download and install quality updates as soon as they’re available on Microsoft’s update servers. Unless an administrator blocks this action, individual users can pause all updates for up to five weeks, one week at a time.

As with all security decisions, choosing when to install updates involves a trade-off. Installing updates immediately after they’re released offers the best protection; deferring updates makes it possible to minimize unscheduled downtime associated with those updates.

On devices running Windows Pro, Enterprise, and Education editions, administrators can defer installation of quality updates by up to 30 days after their release. You can also delay feature updates on these editions by as much as 365 days. On devices running Windows Home edition, there’s no supported way to specify exactly when these updates are installed.

Deferring quality updates by 7 to 15 days is a low-risk way of avoiding the possibility of installing a flawed update that can cause stability or compatibility problems. You can adjust Windows Update for Business settings on individual PCs by using the Local Group Policy Editor (Gpedit.msc); the settings you need are available under Local Computer Policy > Administrative Templates > Windows Components > Windows Update.

Also: 3 essential Windows tools for troubleshooting (and how to use them)

In larger organizations, administrators can apply Windows Update settings using Group Policy or mobile device management (MDM) software. You can also administer updates centrally by using a management tool such as System Center Configuration Manager or Windows Server Update Services.

Finally, your software update strategy shouldn’t stop at Windows itself. Make sure that updates for Windows applications, including Microsoft Office and Adobe applications, are installed automatically.

If you already have a personal Microsoft account tied to services like Microsoft 365 Home or Family or an Xbox Live account, signing in with a Microsoft account makes it easy to access your Office apps and OneDrive storage and online gaming.

Even if you have no Microsoft services, however, there’s a solid security benefit behind that design decision. Signing in with a Microsoft account on Windows 10 or Windows 11 automatically encrypts the contents of the system drive, and the recovery key is backed up to a secure location, accessible by signing in to that Microsoft account. That minimizes the risk that a forgotten password can lead to catastrophic data loss.

Also: Beyond passwords: 4 key security steps you’re probably forgetting

If you don’t use Microsoft services, feel free to create a brand-new Microsoft account on the fly, as part of the setup process, and use that new account exclusively for signing in to Windows. You get the benefits of full system disk encryption, multi-factor authentication, and (if you choose to use it) 5 GB of OneDrive storage, at no extra cost. Just think of it as a local account whose username has @outlook.com on the end.

If you’re still determined to use a local account, you can set up Windows using a throwaway Microsoft account first, and then make the switch to a local account. Just be aware that doing so means you’ll also have to find a different encryption option, and you won’t have any recovery mechanism if you forget your sign-in credentials.

With all that out of the way, do the following as well:

• Set up multi-factor authentication for your Microsoft account. (You’ll find full instructions here: “How to lock down your Microsoft account and keep it safe from outside attackers.”)
• Create standard accounts for other users (and even for yourself). Your primary account, by default, has administrator privileges. If other people (employees or family members) use the same PC, give them standard accounts that are unable to change system settings or install untrusted software without your approval. You can also give yourself a standard account for everyday use, but that’s a needless precaution that will simply force you to type in a password instead of clicking OK to a User Account Control dialog box.
• Install a password manager and make sure all your online accounts have strong, unique login credentials.
• Set up multi-factor authentication for online accounts wherever it’s available. (See “Multi-factor authentication: How to enable 2FA to boost your security”)

For PCs at home, set up children’s access using standard accounts and consider setting up the family safety features in Windows 10 and Windows 11. You can use those options to set authorized times for young people to be online and to help keep them from straying into unsavory corners of the internet. You’ll find all the links you need in the Windows Security app.

Microsoft’s hardware compatibility rules for Windows 11 upped the security game for PCs, although not without controversy. Previously, the governing principle for every new Windows version involved maximum backward compatibility, with even 10-year-old PCs being eligible to install the new operating system.

That all changed with Windows 11. For the first time ever, the official hardware specifications were (a) dramatically increased from the previous version and (b) applied not just to new hardware from PC makers but also to upgraders.

Also: Obsessed with privacy? Keep Tails on a USB drive and secure most any computer

The biggest change is the requirement for a Trusted Platform Module (TPM) version 2.0, along with the requirement to enable Secure Boot (a feature that uses cryptographic signatures to ensure that a device boots with an operating system that hasn’t been tampered with). If you’re willing to make a few registry edits, you can upgrade to Windows 11 from Windows 10 at no charge on a PC with an older TPM version and an unsupported CPU. For details, see this Microsoft support document: “Ways to install Windows 11.”

From the Device Security page in the Windows Security app, you can check both of these settings. If you see entries for Security Processor and Secure Boot, you’re good to go. If one or both of those entries are missing, you’ll need to go into the device’s firmware settings to re-enable the setting. Although there are advanced configurations in which you might need to disable Secure Boot for troubleshooting purposes, it’s best to leave this setting alone.

Finally, set up a Windows Hello PIN and enable biometric authentication if your device has a fingerprint reader or an infrared camera that supports facial recognition.

The single most important configuration change you can make is to enable BitLocker Device Encryption on the system drive and on all secondary drives, including USB flash drives. (BitLocker is the brand name that Microsoft uses for the encryption tools available in business editions of Windows. BitLocker features are identical on Windows 10 and Windows 11.)

Also: How to encrypt your email (and why you should)

With BitLocker enabled, every bit of data on the device is encrypted using the XTS-AES standard. BitLocker uses the Trusted Platform Module (TPM) chip to store the encryption keys.

The steps to turn on encryption features are different depending on which edition of Windows is installed:

• Windows 10/11 Home: This edition supports strong device encryption, but only if you’re signed in with a Microsoft account. It doesn’t allow the management of a BitLocker device.
• Windows 10/11 Pro, Enterprise, or Education: These business editions provide full access to BitLocker management tools. For full management capabilities, you’ll need to set up BitLocker using an Active Directory account on a Windows domain or an Entra ID (formerly known as Azure Active Directory) account. On an unmanaged device running a business edition of Windows, you can set up BitLocker using a local account or a Microsoft account, but you’ll need to use the BitLocker Management tools to enable encryption on available drives.

It is crucial that you backup the recovery key for a BitLocker-encrypted drive. In the event that you ever have to reinstall Windows or experience account problems, you’ll need that 48-digit number to access the data.

If you sign in with a Microsoft account, the BitLocker recovery key is saved in OneDrive by default. You can access it by signing in at onedrive.com/recoverykey. I recommend that you print a copy of that key and file it in a safe place, just in case.

On a managed PC using a domain or Entra ID account, the recovery key is saved in a location that is available to the domain or Entra ID administrator. On a personal device, you can use the Manage BitLocker app to save or print a copy of that recovery key.

Also: Don’t make this USB mistake, protect your data with this encrypted gadget instead

Don’t forget to encrypt portable storage devices. USB flash drives, MicroSD cards used as expansion storage, and portable hard drives are easily lost, but the data can be protected from prying eyes with the use of BitLocker To Go, which uses a password to decrypt the drive’s contents. For details, see “Protect removable storage devices with BitLocker encryption.”)

Finally, make sure that crucial data files are backed up to the cloud and to local storage (on an encrypted drive, naturally). This precaution can be invaluable if you suffer a disk crash, and it’s also excellent protection against ransomware attacks.

If you’re concerned about putting sensitive files in the cloud, encrypt those files using third-party software such as Boxcryptor. OneDrive offers a Personal Vault feature that requires extra verification to access files stored there; Dropbox has a similar feature called Dropbox Vault.

READ MORE HERE