🛡️ Windows Security Hub
Complete Hardening Guide for Windows 11
A comprehensive security hub covering encryption, Defender hardening, privacy lockdown, debloat tools, and advanced threat protection. Built from CIS-aligned benchmarks, Microsoft Security Baselines, and real-world attack patterns — with curated external resources for going deeper.
The Windows Security app is your starting point — all 6 protection modules at a glance. Click Virus & threat protection to begin.
Why Windows Security Matters
Windows is the most targeted desktop OS on the planet. A default Windows 11 installation ships with at least 8 major attack surfaces enabled out of the box — from NTLM authentication fallback to LSASS access from non-protected processes. This hub walks you through closing every one of them, from essential basics to advanced hardening.
What You'll Learn
- Essential Security: BitLocker encryption, Microsoft Defender hardening, firewall configuration, automatic updates, Windows Hello
- Privacy Hardening: Disable telemetry, kill the advertising ID, lock down app permissions, control Windows Recall on Copilot+ PCs
- Advanced Protection: Attack Surface Reduction rules, Credential Guard, Smart App Control, Core Isolation, DNS over HTTPS
- Debloat & Cleanup: Remove pre-installed junk, disable Copilot sidebar, strip telemetry with trusted open-source tools
- Network Security: Firewall lockdown, DNS encryption, disable legacy protocols (SMBv1, NetBIOS, NTLM), VPN configuration
- Honest Limitations: What you can and cannot turn off on Windows 11 Home vs Pro — no false promises
⚠️ 8 Attack Surfaces Windows Ships Enabled
A default Windows 11 installation has these gaps open out of the box. Each section below shows you how to close them.
NTLM Authentication
Legacy auth protocol still enabled, allowing credential relay and pass-the-hash attacks
LM/NTLMv1 Fallback
Outdated hash protocols that can be cracked in seconds, still present on many installs
Unsigned Driver Execution
Kernel-level code can load without signature verification, enabling rootkits
LSASS Access
Non-protected processes can read LSASS memory, exposing credentials to tools like Mimikatz
BitLocker Without PIN
Encryption without a pre-boot PIN means a stolen laptop can be booted and attacked
Office Macros from Internet
Macros from downloaded documents can execute, the #1 initial access vector for ransomware
SmartScreen Bypass
Mark-of-the-web bypass allows downloaded executables to skip reputation checks
PowerShell Without Logging
Script execution without block logging means attacks leave no trace for detection
Windows Security > Virus & threat protection — the launchpad for Defender hardening, ransomware protection, and Controlled Folder Access.
🔐 Essential Security — Do This First
These are the non-negotiables. If you do nothing else, do these 6 things. They close the biggest gaps in a default Windows 11 installation.
BitLocker Full-Disk Encryption (TPM + PIN)
Encrypt your entire drive with XTS-AES256 and require a pre-boot PIN. TPM-only BitLocker is vulnerable to physical bypass attacks (YellowKey, GreatXML zero-days — see CVE Tracker). Available on Pro/Enterprise; Home has lighter "Device Encryption." Back up recovery keys to Microsoft account or USB — never on the same device.
Read Full Guide →Microsoft Defender Hardening
Enable real-time protection, tamper protection, and cloud-delivered protection. Tamper protection prevents malware from disabling Defender. Note: Defender has been targeted by 6+ zero-days in 2026 (ShieldBreak, RoguePlanet, RedSun, UnDefend, BlueHammer) — consider adding a second-opinion scanner like Malwarebytes for defense-in-depth. Verify all settings in Windows Security > Virus & threat protection.
Read Full Guide →Windows Firewall Configuration
Enable the firewall for all network profiles (Domain, Private, Public). Set default to block all inbound connections. The firewall is your first line of defense against network-based attacks — never disable it, even on a trusted network.
Read Full Guide →Automatic Windows Updates (72-Hour Patching)
Ensure Windows Update is enabled and set to install updates automatically. With zero-days dropping after every Patch Tuesday in 2026, the default 7-day delay is too long — configure 72-hour patching for critical updates. Also check Secure Boot certificate status: Windows Secure Boot certs begin expiring June 2026, and unupdated CA material can cause boot failures.
Read Full Guide →Windows Hello & Strong PIN
Set up Windows Hello with a PIN or biometric (face/fingerprint). A PIN is local to the device — even if intercepted, it can't be used on another machine. Pair with a password manager like Bitwarden for unique, strong passwords on every account.
Read Full Guide →Controlled Folder Access
Enable ransomware protection in Windows Defender. Controlled Folder Access blocks untrusted apps from modifying files in protected folders (Documents, Pictures, Desktop). This stops ransomware from encrypting your files even if it gets past Defender.
View Checklist →📚 Go Deeper: Essential Security
For PowerShell commands, CIS Benchmark alignment, and enterprise deployment guidance:
Set your patch cadence to 72 hours in Advanced options — critical in the 2026 zero-day landscape where exploitation now precedes patching.
🕵️ Privacy Hardening — Stop the Tracking
Windows 11 collects diagnostic data, personalizes ads with a per-user advertising ID, and tracks your activity across dozens of settings pages. Here's how to lock it down — with honest limits on what you can and cannot turn off.
Disable Telemetry & Diagnostic Data
Turn off optional diagnostic data in Settings > Privacy & security > Diagnostics & feedback. This stops browsing data, app usage, and enhanced error reports from going to Microsoft. Required diagnostic data (system info, update status) cannot be disabled on Home or Pro — that's the honest floor.
Read Full Guide →Kill the Advertising ID
Turn off all four toggles in Settings > Privacy & security > General: advertising ID, language list access, app launch tracking, and suggested content. Then disable Start menu recommendations and notification suggestions. This stops Windows from building an ad profile on you.
View Checklist →Clear Activity & Search History
Disable activity history storage and clear existing history. Turn off search highlights and search history. Disable Microsoft account and Work/School cloud content search in Start. This prevents Windows from remembering and syncing what you do across devices.
View Checklist →App Permissions Audit
Review every app permission in Settings > Privacy & security — Location, Camera, Microphone, Speech, Contacts, Calendar, and more. Each has a master toggle and per-app list. Disable online speech recognition (stops voice clips going to Microsoft) and audit which apps can see your location.
View Checklist →Windows Recall & Copilot+ Privacy
On Copilot+ PCs, Windows Recall takes screenshots of everything you do for AI search. Disable Recall snapshots in Settings > Privacy & security > Recall & snapshots. If you don't have a Copilot+ PC, this setting won't appear — but check after every feature update, as Microsoft keeps pushing this.
Read Full Guide →Lock Telemetry with Group Policy (Pro Only)
On Windows 11 Pro, use Group Policy Editor (gpedit.msc) to enforce diagnostic data settings so they survive feature updates. Go to Computer Configuration > Administrative Templates > Windows Components > Data Collection and set to "Send required diagnostic data." Home edition has no gpedit — use the registry equivalent.
View Checklist →📚 Go Deeper: Privacy & Telemetry
For the complete toggle-by-toggle walkthrough of every Settings subpage, and an honest account of what cannot be turned off:
The Privacy & security page has 3 sections — the middle one (Windows permissions) is where you kill the advertising ID and lock down diagnostics.
⚙️ Advanced Hardening — Power Users
For users who want to go beyond the basics. These settings close the 8 default attack surfaces, harden credentials, and add behavioral protections that stop sophisticated attack techniques.
Attack Surface Reduction (ASR) Rules
Enable Defender ASR rules to block common attack techniques: Office apps creating child processes, credential stealing from LSASS, executable content from email, untrusted USB processes, and obfuscated scripts. Start in Audit mode for 1-2 weeks to identify false positives before enforcing.
PowerShell Commands →Credential Guard & LSA Protection
Isolate LSASS in a virtualization-based security container so malware can't dump credentials. On Windows 11 24H2 Enterprise, Credential Guard is enabled by default on capable hardware. For other editions, enable via registry or Intune. Pair with LSA Protection to block non-protected process access.
Setup Guide →Disable SMBv1 & Legacy Protocols
SMBv1 is the protocol WannaCry used to spread globally. Disable it along with NetBIOS, LLAMR, and WPAD — all legacy protocols that enable lateral movement. The Windows 11 25H2 baseline now disables NetBIOS by default. Check for legacy printer/NAS dependencies before deploying.
PowerShell Commands →Smart App Control
AI-backed code signing verification that blocks untrusted and potentially dangerous applications. Only available on fresh Windows 11 installs or reset PCs — cannot be enabled on existing devices. Once turned off, it can't be re-enabled without resetting Windows. Best for standard workstations, not developer machines.
Setup Guide →Core Isolation & Memory Integrity
Enable Memory Integrity (HVCI), Kernel-mode Hardware-enforced Stack Protection (KMSS/CET), and Microsoft Vulnerable Driver Blocklist in Windows Security > Device Security > Core Isolation. All 3 toggles ON = defense in depth against ROP-based kernel exploits and BYOVD attacks. The single most impactful advanced security setting in Windows 11.
Read Full Guide →PowerShell Script Block Logging
Enable PowerShell script block logging and transcription so attack techniques leave traces for detection. Without this, PowerShell-based attacks execute invisibly. Configure via registry or Group Policy. Pair with Sysmon for full endpoint detection capability.
PowerShell Commands →📚 Go Deeper: Advanced Hardening
For the full 10-phase enterprise hardening plan, 25H2 baseline changes, and CIS Benchmark alignment:
Turn on BOTH Memory Integrity AND Kernel-mode Hardware-enforced Stack Protection — defense in depth against ROP-based kernel exploits.
🧹 Debloat & Cleanup Tools
Every fresh Windows 11 install comes loaded with apps nobody asked for — Candy Crush, Clipchamp, Disney+, Xbox Game Bar, Copilot sidebar. These trusted, open-source tools remove the junk and lock down privacy settings. All free. No installation required for most.
WinUtil (Chris Titus Tech)
The all-in-one tool. App removal, telemetry blocking, bulk app installation via WinGet, Windows Update management, and custom ISO creation. 46,800+ GitHub stars, 30M+ runs. Pure PowerShell — read every tweak before running. Run from PowerShell: see christitus.com/windows-tool for the one-line installer command.
GitHub Repository →O&O ShutUp10++
Privacy and telemetry settings only — no bloatware removal. Clean list of toggle switches for every privacy setting in Windows. Color-coded recommendations: green = safe, yellow = think about it, red = tradeoffs. Creates a restore point before applying. From O&O Software (25+ years, German company).
Download →Win11Debloat
Focused debloat with a new GUI (February 2026). Removes bloatware, disables telemetry, kills Copilot, restores Windows 10 right-click menu, cleans up taskbar. Configurable app removal list via Apps.json. 39,100+ GitHub stars. Create a restore point manually before running.
GitHub Repository →Sophia Script (Advanced)
150+ individual Windows tweaks, each selectable on its own. Uses only Microsoft's officially documented methods — registry keys, Group Policy, PowerShell APIs. Nothing hacky. Enterprise-friendly with LTSC, GPO, and ARM64 support. Edit a Sophia.ps1 preset file before running.
GitHub Repository →⚠️ Warning: Avoid "Disable All Telemetry" Scripts
Hosts-file blocklists and aggressive "disable all telemetry" scripts from video descriptions can't lower the diagnostic floor — what they actually break is Windows Update, SmartScreen, and Defender cloud protection. That's trading real security features for a false sense of privacy. Use the tools above instead, which make informed, reversible changes.
🌐 Network Security
Your Windows PC is only as secure as the network it's on. These settings encrypt your DNS queries, lock down the firewall, disable dangerous legacy protocols, and protect you on public WiFi.
DNS over HTTPS (DoH)
Encrypt your DNS queries so your ISP and network snoopers can't see which websites you're visiting. Configure in Settings > Network & Internet > Wi-Fi > Hardware properties > DNS server assignment. Use Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) for encrypted, privacy-focused DNS.
Setup Guide →Firewall Lockdown for Public Networks
When on public WiFi (cafes, airports, hotels), set your network profile to Public and enable "Block all incoming connections." This makes your PC invisible to other devices on the network. Verify the firewall is on for all profiles: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
PowerShell Commands →VPN for Untrusted Networks
On public WiFi, a VPN encrypts all your traffic so network operators can't intercept it. Use a reputable VPN (Mullvad, ProtonVPN, or your own WireGuard server). Avoid free VPNs — they monetize your data. Enable VPN kill switch so traffic stops if the VPN connection drops.
Get Help Setting Up →Printer Security (IPPS & TLS)
The Windows 11 25H2 baseline enforces encrypted IPPS and TLS certificate validation for IPP printers. If you use network printers, ensure they support IPPS and have valid certificates. Unencrypted printing exposes documents to network sniffing — a commonly overlooked attack vector.
25H2 Baseline Guide →📚 Go Deeper: Network Hardening
For enterprise network protocol hardening (SMB signing, NTLM disable, NetBIOS, WPAD) and SOHO router configuration:
Secure All Your Devices
Windows is just one piece of your digital ecosystem. Protect your entire setup with device-specific security guides for macOS, iPhone, Android, and your home network.
macOS Security
13 guides: LuLu firewall, FileVault, Wireshark, YubiKey, privacy hardening, and more.
View macOS Hub →iPhone Security
14 guides: Lockdown Mode, Advanced Data Protection, Faraday bags, YubiKey, spyware detection.
View iPhone Hub →Android Security
14 guides: Disable 2G networks, PCAPdroid, NetGuard, spyware detection, Google account hardening.
View Android Hub →SOHO Network Security
Router hardening, network segmentation, IoT isolation, VLAN configuration, and traffic monitoring.
View Network Hub →Need Help Hardening Your Windows PC?
Windows hardening can be complex — ASR rules, Credential Guard, Group Policy, legacy protocol disabling. If you'd rather have it done professionally, I offer hands-on device hardening services. I'll close every attack surface on this page and configure your system to CIS Benchmark standards.