Windows 11 Security Settings: What Home Users Should Check

Windows 11 ships with strong protection, but several of the most useful settings are buried in the Windows Security app, can be switched off by an old driver or a one-time click, and are rarely checked again. This guide walks through every security setting a home user should look at on a Windows 11 PC: sign-in and Windows Hello, standard and administrator accounts, the Windows Security app, Smart App Control, SmartScreen, core isolation and memory integrity, Local Security Authority protection, device encryption, controlled folder access and tamper protection. For each one it says where to find it, what it does, what can break and how to undo a change. It is written for home users and the friends and relatives who look after their PCs; managed business fleets are covered in the Windows Endpoint Hardening Guide.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

Sign in with Windows Hello and protect the Microsoft account behind it. A Hello PIN works only on that one PC, and two-step verification on the Microsoft account protects the encryption recovery key and everything synced to it.
Use a standard account day to day. Microsoft recommends keeping administrators to a minimum and using standard accounts for everyday tasks, so a malicious download cannot change the whole system silently.
Check four panels in Windows Security. Virus and threat protection, Account protection, App and browser control, and Device security should show no warnings; each warning is a setting that has drifted.
Memory integrity and LSA protection are worth fixing, not ignoring. When an old driver blocks them, update or remove the driver rather than leaving the protection off.
Confirm device encryption and know where the recovery key is. On Home editions, device encryption stores the key in the Microsoft account used at setup; without that key, a locked-out drive cannot be recovered.

How identity and access work in Windows 11

On a home PC, "identity" means two things: the account you sign in to Windows with, and the method you use to prove it. Both matter because the Windows account unlocks your files, saved browser passwords and, for most people, the Microsoft account that holds the disk encryption recovery key.

Microsoft account or local account

Option	Security benefits	Trade-offs	Best for
Microsoft account	Device encryption turns on automatically and the recovery key is backed up to the account; the Hello PIN is backed up for recovery; settings sync across devices	The online account becomes a high-value target, so it needs two-step verification	Most households; Microsoft recommends it over a local account
Local account	Nothing stored online; works without internet	Device encryption does not turn on automatically and must be enabled and its recovery key saved manually	Offline or privacy-focused users who will manage the recovery key themselves

Sign-in methods

Windows Hello face or fingerprint: needs a Hello-compatible camera or a fingerprint reader (a USB reader can be added). Set up in Settings, Accounts, Sign-in options.
Windows Hello PIN: Microsoft states the PIN is associated with only one device and backed up for recovery with your Microsoft account. That makes a PIN safer than reusing an online password: someone who learns it cannot use it from another computer.
Password: keep one as a fallback, but it should be long and unique and not used anywhere else.
Microsoft account security: at account.microsoft.com/security, choose Manage how I sign in and turn on Two-step verification. Microsoft says it is phasing out SMS for authentication and account recovery on personal accounts, so set up an authenticator app and a backup email address. You can also remove the password and go passwordless. See the Passkeys for Everyone Guide.

Admin roles and privileged access

The first account created on a Windows PC is an administrator. Administrators can change system settings, install software and access all files. That is exactly what malware wants, so the most effective free hardening step at home is to give each person their own standard account and keep one administrator account for maintenance.

Create the accounts: Settings, Accounts, Other users (shortcut ms-settings:otherusers), Add account. Give each family member their own account; children can be added through Family options so Microsoft Family Safety applies. See the Parental Control Apps Buyer's Guide.
Change the type: select the account, then Account options, Change account type, and choose Standard User or Administrator. Check each account after creation, because the type is not always what you expect.
Use the standard account daily: when an installer needs administrator rights, Windows prompts for the administrator's credentials. That pause is the point: it is a moment to ask whether you meant to install this.
Roll back if needed: if a standard account causes too much friction for one person (for example a home office user who installs work tools often), change the type back, and compensate with Smart App Control and a recent backup.

Decision guidance: a single-person laptop can reasonably keep one administrator account if Smart App Control is on and backups are current. A shared family PC should always use standard accounts for children and occasional users. Never share one account between several people: it mixes saved passwords, browser sessions and files.

Integrations, apps and connected accounts

Home PCs rarely have API tokens or service accounts, but they do have the equivalents: apps that run with your rights, browser extensions, and accounts signed in once and never revisited. Windows 11 controls what may run through three layers in the Windows Security app.

Setting	Where to find it	What it does	What can break, and how to undo
Smart App Control	Windows Security, App and browser control	Asks a Microsoft cloud service whether an app is safe; if no confident answer, blocks apps that are unsigned or have an invalid signature. Works alongside Defender or a third-party antivirus	Blocks some unsigned hobby, developer and older tools, with no per-app exceptions. You can turn it off; recent updates allow turning it back on without a clean install, except where it is off because optional diagnostic data was disabled or the PC is in S mode, which needs a reset
Microsoft Defender SmartScreen	Windows Security, App and browser control, Reputation-based protection	Checks websites against reported phishing and malware lists, and checks downloaded files and apps against reputation data; warns on files with no established reputation. In Edge it also blocks URLs associated with potentially unwanted apps	Shows warnings for rare but legitimate downloads; you can proceed after checking the source. Does not cover files from network shares
Microsoft Defender Antivirus real-time protection	Windows Security, Virus and threat protection, Manage settings	Scans files as they are opened or downloaded	If turned off temporarily, Windows turns it back on automatically. If a third-party antivirus is installed, Defender steps aside; see the Home Antivirus and Security Suite Buyer's Guide
Tamper protection	Windows Security, Virus and threat protection, Manage settings (shortcut windowsdefender://threatsettings/)	Stops malicious apps changing Defender settings such as real-time and cloud-delivered protection; an administrator can still change them in the app	Rarely causes problems; leave it on
Controlled folder access	Windows Security, Virus and threat protection, Ransomware protection	Blocks untrusted apps from changing files in protected folders: Documents, Pictures, Videos, Music, Favorites, the Public equivalents and disk boot sectors. Redirected folders such as OneDrive are protected at their new location	Can block legitimate apps that save into Documents, such as some games and photo tools. Add the app as allowed only if you trust it; allowed apps are matched by file location. Turn it off from the same page

Connected accounts: in Settings, Accounts, Email and accounts, remove accounts you no longer use. In each browser, review extensions and remove anything you do not recognise; extensions can read every page you visit. Store saved passwords in a password manager rather than in several browsers. See the Password Managers Explained for Everyone Guide.

Logging and detection

Home users do not need a log server, but Windows already records the events that tell you something went wrong. Check these monthly, or when the PC behaves oddly.

Where to look	What it shows	What to do
Windows Security, Protection history	Threats found, blocked apps, controlled folder access blocks and actions taken	Read each entry; a block you did not expect means something tried to run
Windows Security home page	Yellow or red warnings on any panel	Open the panel and follow the recommended action
Event Viewer, Applications and Services Logs, Microsoft, Windows, Windows Defender, Operational	Event 1116 (malware detected), 1117 (action taken), 5001 (real-time protection disabled), 5007 (configuration changed), 1123 (controlled folder access block)	An unexpected 5001 or 5007 means someone or something changed protection settings
Microsoft account, Security, sign-in activity	Recent sign-ins to the online account	Unknown location or device: change the password and review two-step verification methods
Settings, Windows Update, Update history	Installed and failed updates	Repeated failures need fixing; an unpatched PC loses much of the value of every other setting

Measures that show it is working

Windows Security status: every panel green on every household PC.
Account hygiene: number of administrator accounts in daily use (target one or none).
Encryption: device encryption or BitLocker on for every laptop, with the recovery key confirmed in the Microsoft account or stored safely offline.
Patch age: days since the last successful monthly update (target under 30).
Core isolation: memory integrity on, with no outstanding incompatible driver warnings.
Microsoft account: two-step verification on, with at least two recovery methods.

Hardening baseline

Work through the PC in this order. Each phase is safe on its own, and the riskiest changes (drivers and encryption) come after a backup.

Update first: Settings, Windows Update, install everything including optional driver updates from the PC maker. Many memory integrity blocks disappear once a driver is updated. See the Patch Management Guide.
Back up: make sure important files are in a cloud service with version history or on an external drive, before changing encryption or driver settings.
Accounts and sign-in: set up Windows Hello, turn on two-step verification on the Microsoft account, create standard accounts.
Windows Security app: confirm real-time protection and tamper protection are on, Smart App Control is On or Evaluation, and reputation-based protection is on.
Device security: open Windows Security, Device security, Core isolation details. Turn on memory integrity, which uses hardware virtualisation to check code before Windows runs it, making it harder for malware to hijack low-level drivers. Confirm Local Security Authority protection is on: it stops untrusted software running inside LSA or reading its memory, which protects sign-in credentials, and needs a restart after changes. Confirm the Microsoft vulnerable driver blocklist is on; it turns on automatically when memory integrity, Smart App Control or S mode is on.
Hardware security: on the same page, check Security processor (the TPM) shows as ready and Secure boot is on. Secure boot prevents rootkits loading at start-up. Only switch it off if you deliberately run another operating system, and switch it back on afterwards.
Encryption: Settings, Privacy and security, Device encryption (shortcut ms-settings:deviceencryption). If the page is missing, the PC does not meet the prerequisites (TPM, Secure Boot, Windows Recovery Environment) or you are using a standard account. Pro editions can use full BitLocker Drive Encryption instead. Confirm the recovery key appears in your Microsoft account. See the Disk Encryption Guide: BitLocker and FileVault.
Ransomware protection: turn on controlled folder access if you can tolerate occasional "allow this app" prompts; otherwise rely on versioned backups.
Firewall: confirm Firewall and network protection shows all three network profiles on. See the Windows Defender Firewall Guide.

Rollback: if memory integrity causes a device to stop working, turn it off from the same page and restart, then look for an updated driver. If the PC will not start after a firmware change, revert the UEFI setting. If BitLocker asks for a recovery key after a firmware update, enter the key from your Microsoft account; this is why the key check comes first.

Which setting stops which threat

Threat	MITRE ATT&CK	Windows 11 setting	NIST SP 800-53 / CSF 2.0
Phishing links and fake sites	T1566 Phishing	SmartScreen, Microsoft account two-step verification	SI-3, IA-2 / PR.AA-03
Running a malicious download	T1204.002 Malicious File	Smart App Control, SmartScreen, Defender real-time protection, standard account	SI-3, CM-7, AC-6 / PR.PS-01
Stealing sign-in secrets from memory	T1003.001 LSASS Memory	LSA protection, Windows Hello	AC-6, IA-2 / PR.AA-03
Abusing a vulnerable driver	T1068 Exploitation for Privilege Escalation	Memory integrity, vulnerable driver blocklist, updates	SI-2, CM-7 / PR.PS-02
Boot-level malware	T1542.003 Bootkit	Secure boot, TPM, firmware protection	CM-7 / PR.PS-01
Ransomware encrypting files	T1486 Data Encrypted for Impact	Controlled folder access, versioned backups	SI-3 / PR.DS-01
Theft of a laptop	Physical access	Device encryption or BitLocker	SC-28 / PR.DS-01

Common misconfigurations

Memory integrity left off because of one old driver. The warning often names a driver for a printer, game controller or utility nobody uses any more. Removing it restores a protection that defends against driver abuse.
Encryption on, recovery key unknown. A PC set up with a relative's Microsoft account, or a local account that enabled encryption manually, can lock its owner out after a hardware change. Confirm whose account holds the key.
Smart App Control switched off for one installer. People turn it off to run a single tool and forget it. Check whether it can be turned back on, and if the tool is unsigned, ask whether you need it.
Everyone uses the administrator account. Children installing game mods or "free" utilities with full rights is one of the commonest routes to infection on family PCs.
Calling the number in a security pop-up. Windows Security never asks you to phone anyone. See the Recognising Tech Support Scams Guide.
Two antivirus products fighting. Installing a suite on top of another suite slows the PC and can leave gaps. Keep one, and check Windows Security shows which product is active.

Practitioner checklist

Install all Windows and driver updates, then confirm Update history shows no repeated failures.
Set up Windows Hello and turn on two-step verification on the Microsoft account with an authenticator app and a backup email.
Give each person a standard account and keep one administrator account for maintenance.
Confirm real-time protection, tamper protection and reputation-based protection are on, and Smart App Control is On or Evaluation.
Turn on memory integrity and confirm LSA protection and the vulnerable driver blocklist are on; update or remove any blocking driver.
Check the TPM is ready and Secure boot is on.
Turn on device encryption or BitLocker and confirm the recovery key is in the Microsoft account or stored offline.
Turn on controlled folder access or confirm a versioned backup exists.
Review Protection history and remove unused accounts and browser extensions every month.

Windows 11 Security Settings Guide: Every Setting Home Users Should Check