Windows security: supported releases, active protection and safer sign-in

Windows security depends on a supported release, installed patches, Windows Security staying on, and disk encryption. Ordinary Windows 10 support ended on 14 October 2025. Extended Security Updates (ESU) are only a temporary bridge and, for eligible consumer devices, run through 12 October 2027; they do not bring new features or full technical support. Do not put off planning a move to a supported version.

What to choose after Windows 10 support ends is covered separately in after Windows 10 support ends. A short device review is in the device security checklist.

Keep a version that still receives patches

Windows that no longer gets security patches becomes more exposed to newly found holes every week, even if it “still works fine”. First see what is installed.

1. Go to Settings > System > About. Read the Windows specifications, version and build number.
2. Match that against Microsoft’s official lifecycle page. Windows 11 is still on a yearly update path; after 14 October 2025, Windows 10 does not get ordinary security patches without ESU.
3. If you have Windows 10 and the device meets Windows 11 requirements, check for an upgrade under Settings > Windows Update. Take a backup before you upgrade.
4. If the device cannot run Windows 11, either enrol in ESU until you upgrade or replace it, or stop using that PC for sensitive work and important accounts.
5. Older versions such as Windows 7 and 8.1 have been without ordinary patches for years and are not suitable for mail and banking.

Do not treat ESU as a destination. It only delivers important and critical security updates, not new capabilities. Its end date is also near; see the end-of-support guide for enrolment details and limits.

Get updates from Windows itself

1. On Windows 11 go to Settings > Windows Update. On Windows 10 the path is Settings > Update & Security > Windows Update.
2. Check for updates and install all quality and security updates.
3. If Windows asks to restart, do not put it off; some patches are not fully applied until then.
4. Look at optional updates and driver updates here too from time to time, especially after you change hardware.
5. Do not download an update package from a message or an unknown site. A fake “Windows repair” tool is a common malware path.

Do not turn off the built-in protection

Windows Security is the official anti-malware. Turning it off to install a “stronger antivirus” from an advert usually makes the device weaker, not stronger. If you install another reputable product, let it coordinate with this layer; two incompatible engines sometimes treat each other as a nuisance.

1. Go to Settings > Privacy & security > Windows Security and open the app.
2. Under Virus & threat protection, check that real-time protection is on and that no threat is waiting for action.
3. Run a quick scan and confirm on that same page that definitions are up to date.
4. Leave cloud-delivered protection and sample submission on if that fits your privacy; for most people they help against new threats.
5. If ransomware is a concern, review controlled folder access. It makes unapproved writing to document folders harder and may prompt you once about a known program too.

SmartScreen and the firewall

1. In Windows Security open App & browser control.
2. Leave SmartScreen on for apps and for Microsoft Edge. Do not bypass a warning about running an unknown file unless you have confirmed the source another way.
3. Under Firewall & network protection, check that the firewall is on for domain, private and public networks.
4. Keep a home network private and a café or airport network public so sharing is not opened by accident.
5. If a program asks to get through the firewall, read its name. Do not give a permanent allow to an unknown tool.

Make sign-in stronger than a short password

1. Go to Settings > Accounts > Sign-in options.
2. Set a PIN or Windows Hello (face or fingerprint, if the device supports it). A PIN stays on that device and is not the same as separately stealing the Microsoft account password; still, do not choose a simple four-digit PIN.
3. Keep the account password unique. If you sign in with a Microsoft account, turn on that account’s two-factor authentication from the Microsoft account security page.
4. Turn off automatic sign-in and require a lock after a period of inactivity.
5. For other people on this PC, create a standard user and do not do everyday work from an administrator account without a reason.

User Account Control (UAC) asks when a program wants administrator rights. Do not approve it every time. If a prompt appears suddenly in the middle of something else, say no.

Device encryption and BitLocker

Without encryption, removing the drive from a locked laptop is often enough to read the files. On Windows Home this layer is usually called device encryption; Pro editions give finer control with BitLocker.

1. Go to Settings > Privacy & security > Device encryption. If that page exists, turn it on.
2. If it does not, open BitLocker from Windows search and encrypt the system drive. The device may need prerequisites such as a TPM and Secure Boot.
3. Save the recovery key at that moment: print it, keep a separate file, or store it in the Microsoft account. A copy only on that same PC is not enough.
4. If the key is stored in the Microsoft account, lock that account with a unique password and two-factor authentication, and take a separate copy too.
5. Encrypt a flash drive that holds sensitive files separately with BitLocker To Go or file encryption; system-disk encryption does not cover it. On Pro you can see each drive’s status and back up the key again from the BitLocker management page; on Home the Device encryption page is usually enough.

Find my device

1. Sign in with a Microsoft administrator account.
2. Go to Settings > Privacy & security > Find my device and turn it on. Location services must be on.
3. Once, sign in at account.microsoft.com/devices with the same account and check that this PC is in the list.
4. If the device is lost, view the approximate location from that page and remotely lock it if needed. Then review the account password from a healthy device. Note that requesting the location may show a notification on the device itself; that helps when you are finding a misplaced laptop at home, and if you are concerned that someone is sitting at it at that moment, put a remote lock and a password change first.
5. This feature is not a substitute for encryption; it only helps you find or lock the device.

File extensions, startup apps and sharing

1. In File Explorer, turn on file name extensions so that “invoice.pdf.exe” cannot hide behind a document icon.
2. Go to Settings > Apps > Startup and remove an app you do not recognise from starting automatically.
3. Under Settings > Apps > Installed apps, uninstall anything new that you do not remember installing.
4. Turn off file sharing and remote desktop if you do not use them. Do not leave Remote Desktop open on a public network.

A Microsoft account and a local account

A Microsoft account makes it easier to sync settings, find the device and sometimes store the recovery key, and it also means that same account is a way into several things. A local account reduces dependence on the cloud but makes password recovery and Find my device harder. Whichever you choose, set a unique password and, if it is a Microsoft account, lock it like a primary mailbox. On a shared PC, each person should have a separate Windows account.

Before selling or leaving a PC for repair

1. Take a backup and keep the BitLocker key separately.
2. From Settings, reset this PC and remove the files, or wipe the disk so that a fresh setup starts for the buyer without your account.
3. Before you hand it over, turn the device on and check that the setup assistant appears, not your desktop.
4. If you are only leaving it for repair and not wiping it, keep the sign-in lock and remove especially sensitive files.

Common mistakes

• Staying on Windows 10 without ESU after 14 October 2025 because “it still opens”.
• Turning off Windows Security to install an advertised tool.
• Bypassing a SmartScreen warning for a file that arrived in a message.
• Encrypting the disk and never storing the recovery key off that same PC.
• Doing everyday work as an administrator and approving every UAC prompt.
• Leaving the network set to private on airport Wi-Fi.

See whether the device can run Windows 11 at all

An upgrade only makes sense if the hardware meets the minimums: TPM 2.0, Secure Boot, and a supported processor. Microsoft shows this in Windows Update or with the PC Health Check app.

1. If Windows Update has a message about eligibility, read that.
2. If you need it, get the official PC Health Check app from Microsoft, not from a third-party download site.
3. If TPM or Secure Boot is reported as off in the OS, it may be switchable in firmware settings. Do that only if you know how to get back into those firmware settings.
4. If the device does not qualify, choose consciously among temporary ESU, replacing the device, or limiting sensitive work on it.

Device security: core isolation and Secure Boot

1. In Windows Security go to Device security.
2. Turn on core isolation and memory integrity if the device supports them. This layer makes memory exploits harder and sometimes clashes with an old driver; if a program breaks, update that driver from its maker rather than leaving the protection off forever.
3. Check Secure Boot and the security processor (TPM) there too. If you turn these off to install another system, turn them back on when you finish.

App permissions and location

1. Go to Settings > Privacy & security.
2. Open Camera, Microphone and Location and turn off access for an app that should not always be listening or sending location.
3. Location services can stay on if you need them for Find my device; that is different from giving every app your location.
4. If the PC offers saved activity snapshots or a similar feature, review it under privacy and turn it off if you do not want a history of the screen kept. That kind of feature discloses more than a documents folder if an account is taken over or someone sits down at the device.

A standard account and User Account Control

1. Go to Settings > Accounts > Other users and create a standard account for someone who sometimes uses the PC.
2. If you can, do your own everyday work from a non-administrator account.
3. Set the UAC slider, from Control Panel under User Accounts, so that it at least asks when a program is installed.
4. Look at any shortcut that runs a program “as administrator” for ordinary work; do not make that a habit for the browser and mail.

Choose the right network profile

1. Go to Settings > Network & internet and open the connected network.
2. Set the profile to private at home and public on a public network.
3. Leave nearby sharing and network discovery off on a public network.
4. If you join hotel Wi-Fi, treat it as public even if the network name looks familiar.

Do not leave Remote Desktop on

1. Go to Settings > System > Remote Desktop.
2. Turn it off if you do not use it.
3. If you do need it, allow only a specific account, limit the network, and never leave it open to the home internet without an extra layer.
4. Install third-party remote-access tools only from a known maker, and close the session when support is finished.

Where you get the BitLocker key back

If you stored the key in the Microsoft account when you turned encryption on:

1. From another device, go to the official Microsoft account devices page and sign in with that same account.
2. Find the BitLocker recovery key for this device. Read the characters carefully.
3. Take a fresh copy on paper or in a password manager, away from that PC.
4. If there is no key and you have also forgotten the sign-in password, the encrypted disk’s content usually cannot be recovered. Take that seriously before an incident.

How to show file extensions

1. Open File Explorer.
2. From the View menu, turn on file name extensions. On Windows 11 this option is under View or in Explorer’s options.
3. To check, look at a file you know and confirm its real extension is visible.
4. Do not run a file with two extensions, or an executable extension, that arrived in a message.

Keep antivirus exclusions few

Under virus and threat protection, manage settings sometimes lets you exclude a folder from scanning. Every exclusion is a blind spot. Do not exclude Downloads or the desktop. If a program asks for an exclusion in order to work, first check the program itself from an official source.

Windows Backup is not a substitute for encryption

Windows Backup under account settings can sync folders with a Microsoft account. That helps when you replace a PC, but an independent copy on a separate disk still has its place. How to build a copy you can actually restore is in the backup guide in this set. Refresh that backup before you upgrade from 10 to 11 or before you reset the PC.

If you are still on Windows 10

Without ESU, ordinary security patches stopped after 14 October 2025. Enrolment for eligible devices is usually done from Windows Update itself with a Microsoft account. Consumer coverage runs through 12 October 2027 and only delivers important and critical security updates. Until you enrol, the device is more exposed to holes found after support ended. The options — upgrade, replace, or this temporary bridge — are in the end-of-support guide.

1. Open Windows Update and, if there is an ESU enrolment notice, follow that official path.
2. Do not download an “ESU activator” file from a third-party site.
3. At the same time, make a plan to move to Windows 11 or a new device; do not treat ESU as permanent.

An offline scan when the device’s behaviour changes

A quick scan is enough for an everyday doubt. If a suspicious program was installed or the system’s behaviour has clearly changed, open scan options under virus and threat protection and run a Windows Security offline scan. The device restarts and checks before Windows fully loads. After that, remove unknown apps from the app list and, if you opened a file, see the malware guide in this set.

Dynamic lock, idle time and nearby sharing

1. Under sign-in options, if Dynamic lock is available and you have a paired phone, you can have the PC lock when the phone moves away. That is convenience, not a substitute for a strong sign-in.
2. In system settings, display and power, shorten the time until the screen turns off and require a lock after that.
3. Turn off nearby sharing in system settings unless you are handing a file to a device next to you at that moment.
4. Clipboard history, if it syncs between devices, may take something you copied somewhere else; limit it on a shared PC.

The Microsoft account security page

1. In the browser, type the official Microsoft account security address yourself; do not follow a link in a message.
2. Review sign-in activity, devices and two-factor methods.
3. Remove an unknown device or app.
4. If a BitLocker key is stored there, confirm it exists and take a separate copy.
5. Do not make this account’s password the same as a local sign-in password if you have both, and keep it in a password manager.

An encrypted flash drive, and where you install software

1. For a sensitive flash drive, open BitLocker on this PC and turn on encryption for the removable drive. Set a separate passphrase and do not write it on a label stuck to the stick.
2. Get software from the official Microsoft Store or the maker’s site.
3. Leave Developer Mode off under Privacy & security if you do not need it for work, so installing from any source does not become easy.
4. Do not run an installer whose name is close to a well-known program from the first search result.

If the PC is lost

From the Microsoft account, open Find my device, look at the approximate location and use a remote lock. Change the account password. If encryption was already on, someone who picked up a powered-off device cannot read the files easily. Do not remove the device from the account list until you know what happened to it. If malware or phishing was also involved, follow those guides.

Do not pause updates for months

Windows lets you pause updates for several days. That is sometimes needed for a presentation or a short trip. Leaving them paused for months means those same security patches do not arrive. When you return, lift the pause and check Windows Update by hand once so the backlog does not sit there.

Know recovery and reset before you need them

1. Go to Settings > System > Recovery.
2. Read the reset this PC option so that on the day you need it you already know the choice between keeping files and wiping everything. Take a backup before any reset.
3. A system restore point, if it is on, helps roll back settings after a bad driver install; it does not replace a file backup.
4. Make the lock shortcut a habit: Windows logo key + L locks the screen at once. Press it before you stand up from the desk.

If you forget a Windows Hello PIN, use the official reset-PIN path on the same sign-in options page. That usually asks for the account password. Do not install an unknown tool that claims to recover the PIN without the password.

Tamper protection and a second antivirus

Under virus and threat protection settings, leave tamper protection on so unwanted software cannot easily turn the anti-malware off. If Windows Security says another antivirus is active, check whether you installed it yourself. An unknown tool that appeared without you doing anything should be removed. If a reputable workplace antivirus is installed on a work device, follow that organisation’s policy and do not double up the official layer without a reason.

1. Find tamper protection under manage settings in that same section and confirm it is on.
2. Read a notice that says another provider is managing protection, and recognise the program’s name.
3. If you do not recognise the name, remove it from installed apps and run a full scan.

What to do from today

1. Look at the Windows version in About and, if support has ended, decide on an upgrade path or ESU.
2. Run Windows Update and restart.
3. Check Windows Security, real-time protection, SmartScreen and the firewall.
4. Turn on device encryption or BitLocker and keep the recovery key separately.
5. Strengthen sign-in options, confirm tamper protection, and turn on Find my device if you use a Microsoft account.