iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The reliable way to protect Windows systems from ransomware is layered defense: patch every exposed component, keep Microsoft Defender protections active, block unauthorized file changes, harden accounts and remote access, segment servers, and maintain offline encrypted backups that you have actually restored in a test. No single setting prevents every attack. Your goal is to make intrusion difficult, limit how far malware can move, detect it quickly, and recover without relying on a ransom payment.
What ransomware protection must accomplish
Ransomware typically combines an initial foothold with credential theft, lateral movement and mass file encryption. An attacker may enter through a vulnerable internet-facing service, a stolen password, a malicious attachment, an exposed remote desktop connection or an unpatched VPN or network appliance. Once inside, the attacker looks for administrator privileges, file shares and backup systems.
Effective protection therefore has four objectives:
Recommended Free Tools
- Prevent entry: patch vulnerabilities, reduce exposed services and require strong authentication.
- Limit execution and file damage: use Defender, application controls, least privilege and Controlled Folder Access.
- Contain movement: segment networks, restrict SMB and RDP, and separate administrative paths.
- Recover safely: keep isolated, encrypted backups and rehearse restoration from a clean environment.
Apply these controls to workstations, laptops, virtual machines, domain controllers, file servers, hypervisors, cloud-connected identities and the network devices that connect them.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Patch Windows, applications and exposed infrastructure first
CISA describes timely patching as one of the most efficient and cost-effective ways to reduce ransomware exposure. Prioritize vulnerabilities that are already known to be exploited, especially on internet-facing systems.
What to patch
- Windows operating-system security and quality updates.
- Web browsers, PDF readers, productivity software, Java or .NET components and other commonly opened applications.
- VPN gateways, firewalls, email systems, remote-management tools and network appliances.
- Firmware and management interfaces on servers, storage arrays and virtualization hosts.
- Third-party applications running on servers, including line-of-business software.
A practical patching sequence
- Maintain an inventory of PCs, servers, software versions, internet-facing addresses and system owners.
- Subscribe to vendor security advisories and identify vulnerabilities marked as exploited or critical.
- Patch public-facing services and remote-access infrastructure first, after confirming a tested rollback or recovery path.
- Deploy updates to a representative pilot group, then expand to the rest of the fleet.
- Verify installation, reboot requirements and application function; record exceptions with an owner and a deadline.
Unsupported operating systems and applications should be upgraded or removed. If a legacy application cannot be replaced, isolate it, restrict its network access and monitor it more closely rather than leaving it broadly reachable.
Configure Windows Security and Defender
Windows Security provides a strong baseline when its protections, signatures and automatic updates remain enabled. In a business environment, enforce settings centrally and protect the management policy from unauthorized changes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Turn on Controlled Folder Access
Controlled Folder Access (CFA) in Microsoft Defender Antivirus allows only trusted applications to change files in protected folders. It creates a barrier against many unauthorized encryption attempts, but it can also block legitimate software that writes to protected locations.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Open Windows Security.
- Select Virus & threat protection.
- Choose Manage ransomware protection.
- Turn on Controlled folder access.
- Use Protected folders to add important local or network-backed data directories that are not included by default.
- Use Allow an app through Controlled folder access only for applications you have verified and trust.
Start in audit mode, where your management tooling supports it, or pilot the blocking mode with representative applications. Review events for accounting, database, design, backup and line-of-business software before broad deployment. Do not add an entire drive or an unknown executable merely to silence a prompt.
Keep Defender’s preventive controls active
- Allow automatic security-intelligence updates and automatic sample submission where your privacy and regulatory requirements permit.
- Keep real-time protection, cloud-delivered protection and tamper protection enabled.
- Review protection-history events and investigate repeated detections instead of dismissing them.
- Use centralized policy for managed PCs so a local administrator cannot quietly disable protection.
Defender is a layer, not a substitute for patching, identity controls or backups. An attacker who obtains valid credentials can sometimes operate without dropping a file that antivirus recognizes.
Protect identities and reduce privilege
Stolen credentials are a major ransomware attack path. Protect email, VPN, remote administration, cloud consoles and privileged Windows accounts with phishing-resistant multifactor authentication whenever the service supports it.
Use stronger authentication
- Prefer passwordless or cryptographic-key methods, such as FIDO2/WebAuthn security keys, for administrators and other high-impact accounts.
- Require multifactor authentication for Microsoft 365, VPN, remote-management portals and privileged access.
- Do not approve unexpected sign-in prompts. Investigate the request and report suspected phishing.
- Use separate daily-use and administrator accounts; never browse the web or read email while signed in as a domain administrator.
Apply least privilege
- Remove unnecessary users from local Administrators and high-impact Active Directory groups.
- Use time-limited or just-in-time elevation where your identity platform supports it.
- Store service-account credentials securely, rotate them and restrict where each account may log on.
- Disable dormant accounts and immediately revoke access for departing staff, contractors and suppliers.
Review privileged-group membership on a schedule and after organizational changes. A password reset alone is not enough after a suspected compromise: revoke sessions, rotate secrets and investigate where the credentials were used.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Reduce risky remote access
Remote Desktop Protocol (RDP), VPN appliances and remote-management tools deserve special attention because they provide a direct path into internal systems.
RDP controls
- Do not expose RDP directly to the public internet. Put it behind a VPN or a tightly controlled gateway.
- Require multifactor authentication for the remote-access path and privileged sessions.
- Allow connections only from approved administrators, source networks and managed devices.
- Disable unused RDP services, restrict clipboard and drive redirection where practical, and log successful and failed sessions.
- Use separate administrative jump hosts instead of administering sensitive servers from ordinary workstations.
VPN and appliance controls
- Patch VPN concentrators, firewalls and other edge devices promptly because they are internet-facing entry points.
- Remove unused accounts, old tunnels and default credentials.
- Limit vendor or contractor access to approved time windows and systems.
- Alert on impossible travel, unusual geographies, repeated authentication failures and new administrative sessions.
Harden Windows servers and file shares
Servers need containment controls in addition to endpoint antivirus. A compromised workstation should not be able to reach every file server, backup repository and domain controller.
Use safe SMB settings
Disable SMBv1 after checking application dependencies, and prefer SMBv3.1.1. Test older scanners, appliances and line-of-business applications before removing compatibility protocols. Restrict file-share access to the users and systems that require it, and remove broad “Everyone” write permissions where possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Segment critical systems
- Place user workstations, application servers, file servers, domain controllers, backup infrastructure and management interfaces in separate network segments.
- Permit only documented ports and flows between segments.
- Block workstation-to-workstation administration unless there is a defined operational need.
- Keep backup networks and repositories inaccessible from ordinary user credentials.
Control execution and monitor servers
- Use application allowlisting with Windows Defender Application Control (WDAC) or AppLocker when staffing and compatibility allow.
- Deploy endpoint detection and response (EDR) to business-critical servers and workstations.
- Forward authentication, process, PowerShell, file-share and security-product events to a protected central log.
- Maintain golden images or documented rebuild procedures for critical servers.
Application allowlisting and EDR can generate operational work: legitimate updates may need policy changes, and unsupported applications can fail. Pilot them, document exceptions and monitor before enforcing them across every server.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Build backups that ransomware cannot erase
A backup is useful only if it remains available, intact and restorable after an attack. CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario.
Use more than one recovery copy
- Keep a local backup for fast recovery from ordinary hardware or user errors.
- Keep at least one encrypted copy offline or otherwise isolated from routine credentials and administrative paths.
- Use versioned or immutable retention so an attacker cannot rewrite every historical copy.
- Protect backup-management consoles with separate administrator accounts and multifactor authentication.
An external encrypted hard drive or SSD can serve as an offline copy when its capacity matches the workload. Disconnect it after the backup completes; a drive permanently attached to the PC is reachable by ransomware.
Test restoration, not just backup jobs
- Define recovery priorities: identity services, core applications, file shares, user devices and less-critical systems.
- Schedule a file-level restore test and a full-system or server recovery test.
- Restore into an isolated environment and verify permissions, application consistency, databases and required dependencies.
- Measure how long recovery takes and compare it with business requirements.
- Record contacts, credentials, recovery order, media locations and decisions that must be made during an incident.
Versioned cloud file storage can help recover individual user files, but it should not be your only copy of critical data. Preserve an independent offline or isolated backup because synchronized storage can also propagate deletions or encrypted files.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use a repeatable maintenance checklist
| Frequency | Checks |
|---|---|
| Daily or automated | Defender signatures, endpoint alerts, backup-job status, failed logins and high-risk administrative activity. |
| Weekly | Review ransomware-related detections, new software vulnerabilities, exposed services and backup isolation status. |
| Monthly | Patch operating systems and applications, review local administrators and privileged groups, test a representative file restore. |
| Quarterly | Perform a server or full-system recovery exercise, review network segmentation and RDP rules, and remove obsolete accounts and software. |
| After major change | Re-test CFA compatibility, backup restoration, identity recovery and firewall rules after migrations, acquisitions or new applications. |
What to do when ransomware is suspected
Speed matters, but careless actions can destroy evidence or spread the encryption.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
- Isolate the affected system. Disconnect network cables or disable wireless and logical network access in a way that preserves evidence. Do not immediately wipe the device.
- Contain possible lateral movement. Isolate adjacent systems, disable affected shares and suspend suspicious accounts when your incident plan calls for it.
- Contact the incident-response lead. Preserve ransom notes, filenames, timestamps, alerts, memory or disk evidence where your response procedure requires it, and relevant logs.
- Identify the entry path. Check recent VPN and RDP sessions, phishing messages, endpoint alerts, vulnerable services and unusual administrative activity.
- Reset exposed credentials. Rotate passwords, service secrets, tokens and keys from a clean administrative workstation; revoke active sessions.
- Close the exploited path. Patch the vulnerable service, remove unauthorized remote access, disable compromised accounts and correct firewall or share permissions.
- Decide between cleaning and rebuilding. Use trusted tools for scanning and removal when integrity is established. Rebuild from known-good media or a golden image when system integrity is uncertain.
- Restore only after containment. Validate that the environment is clean, then restore in the documented order and monitor restored systems closely.
Microsoft warns that paying money does not guarantee that you will regain access to your PC or files. Payment can also leave the underlying compromise unresolved, so restoration and eradication remain necessary.
Choosing protection tools or services
When evaluating a product or managed service, compare capabilities rather than relying on a malware-detection label.
| Evaluation area | Questions to ask |
|---|---|
| Protection scope | Does it cover one PC, all endpoints, servers, identity systems and network devices? |
| Recovery assurance | Are copies encrypted, offline or immutable? Are restore tests included, documented and measured? |
| Administration and alerting | Can staff enforce policy centrally, investigate events and receive actionable alerts? |
| Compatibility | Will CFA, application allowlisting or EDR interfere with line-of-business software, scripts, shares or performance? |
| Identity integration | Does it work with your Microsoft identity, endpoint-management and multifactor-authentication controls? |
| Total cost | Include licensing, storage, retention, implementation, monitoring, restore labor and incident-response support. |
Pilot controls on representative devices and servers. A tool that cannot be monitored, updated or supported by your team can create a false sense of security.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
A practical 30-day rollout
Days 1–7: close obvious gaps
- Inventory systems and exposed services.
- Patch internet-facing services, VPNs, operating systems and browsers.
- Confirm Defender, automatic updates and tamper protection are active.
- Remove unused public RDP access and default accounts.
Days 8–14: protect identities and data
- Require phishing-resistant MFA for administrators, email, VPN and remote administration.
- Separate daily and administrative accounts and review privileged groups.
- Enable CFA in audit or pilot mode and add critical data directories.
- Identify critical data, recovery priorities and backup owners.
Days 15–21: contain the environment
- Disable SMBv1 after dependency testing and move compatible systems to SMBv3.1.1.
- Segment workstations, servers, domain controllers and backup systems.
- Restrict share permissions, administrative protocols and vendor access.
- Deploy EDR or application allowlisting where you can operate it effectively.
Days 22–30: prove recovery
- Create or verify encrypted offline or isolated backup copies.
- Perform a file restore and a full-system or server recovery test.
- Document rebuild media, contacts, credentials, recovery order and evidence-preservation steps.
- Turn lessons from the exercise into assigned remediation work.
Common mistakes that undermine protection
- Keeping backups connected: an attached backup share can be encrypted along with production data.
- Allowing broad administrator rights: one stolen account can then disable controls and reach more systems.
- Exposing RDP for convenience: convenience does not justify an unmanaged public entry point.
- Enabling CFA without testing: legitimate applications may fail if they are not audited and allowlisted correctly.
- Trusting a successful backup job: a completed job does not prove that the data or recovery environment is usable.
- Restoring before eradication: reintroducing systems while credentials or access paths remain compromised can restart the incident.
- Ignoring small servers and appliances: attackers use overlooked systems as stepping stones into better-protected networks.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
