4 built-in windows 11 settings that actually protect you
four settings already sitting in your windows 11 pc doing nothing
here's the thing nobody tells you when you buy a new laptop: windows 11 already ships with real security tools built in. not third party junk, not a $60/year subscription, just settings sitting in the menus waiting for someone to flip them on. most people never do. this post walks through four of them, what they actually protect against, and exactly where to go to turn them on. five minutes, zero extra software.
1. bitlocker: turns a stolen laptop into an expensive brick
if your laptop gets stolen or you leave it in a coffee shop (we've all done it), the hard drive itself is not encrypted by default on every machine. that means someone can pull the drive, plug it into another computer, and read every file on it, no password needed. bitlocker encrypts the entire drive so that without your key, the data is unreadable garbage. the thief gets a brick, not your tax returns and saved passwords.
to turn it on, go to settings > privacy & security > device encryption, or search "bitlocker" in the start menu and open "manage bitlocker." if your device supports it, you'll see an option to turn it on for your system drive. windows will walk you through saving a recovery key, and this part matters: save that key somewhere other than the same laptop. a microsoft account, a printed copy, a password manager, anywhere that isn't the device itself. if you lose the key and the drive, you're locked out of your own data too.
2. controlled folder access: ransomware protection you already own
ransomware works by encrypting your files and demanding payment to get them back. controlled folder access is microsoft defender's built in way of stopping that before it happens. it locks down folders like documents, pictures, and desktop so that only apps you've approved can make changes to files in there. a random piece of malware trying to encrypt everything in your documents folder just gets blocked, full stop.
find it under windows security > virus & threat protection > manage ransomware protection, and flip controlled folder access to on. by default it protects your main user folders, but you can add more folders if you keep important files elsewhere. the only downside is occasionally a legit app you trust gets blocked too, but windows lets you allow it through with one click. that's a much better problem to have than a ransom note.
3. remove smbv1: the protocol wannacry used to spread itself
smbv1 is an old file sharing protocol from the 90s that windows kept around for compatibility with ancient network gear. the problem is it has known, serious vulnerabilities, and it's exactly how wannacry ransomware tore through networks worldwide in 2017. it doesn't just sit there quietly, it's an open door if something malicious gets onto your network.
modern windows 11 installs usually have it off by default, but it's worth checking, especially on machines that have been upgraded from older versions of windows. open powershell as administrator and run:
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocolif it says "enabled," turn it off with:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocolthat first command just checks the current state, it doesn't change anything. the second one disables the feature and may ask for a restart. unless you're running decades old printers or file servers that genuinely require it, you will not miss smbv1.
4. firewall on for every profile, not just one
windows firewall is good, but it runs separate profiles for domain, private, and public networks, and it's possible for one of those to get switched off without you noticing, especially after installing certain software or troubleshooting a connection issue months ago. an off profile means that specific network type has no firewall protection at all.
check all three under control panel > system and security > windows defender firewall, then click "turn windows defender firewall on or off" on the left side. make sure all three profiles show as on. this matters most on public wifi, where a firewall is the difference between your laptop being invisible on the network and broadcasting open ports to everyone else at the airport.
the takeaway
none of this requires buying anything or trusting a third party app with your data. it's four menus, five minutes, and tools microsoft already built and already shipped to you. go check your own machine right now, then send this to the relative who still thinks "windows update" is optional. protecting your own systems isn't about doing more, sometimes it's just about turning on what's already there.