iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Windows 10 and Windows 11 include several useful protections in the Windows Security app that are easy to overlook. Review Tamper Protection, Controlled folder access, and reputation-based protection, then check the other protection areas that fit your needs. These settings do different jobs; none is a guaranteed or quantified improvement in security.
This guide covers the built-in Windows Security experience and Microsoft Defender Antivirus settings. It does not refer to the separate Microsoft Defender app offered with some Microsoft 365 subscriptions.
Where to find the built-in protections
Open Start, search for Windows Security, and open the app. Choose Virus & threat protection for Defender Antivirus settings such as Tamper Protection and Controlled folder access. Choose App & browser control for reputation-based protection and related app controls.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Labels and available options can vary by Windows version and device policy. Some Windows Security pages or features may not be available on a device managed by an organization.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check Tamper Protection
Tamper Protection helps prevent malicious apps from changing important Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection. With it on, an administrator can still change settings in Windows Security, but other apps cannot make those changes.
In Windows Security, open Virus & threat protection, then select Manage settings under Virus & threat protection settings. Find Tamper Protection and check its status. If the control is unavailable, a device policy may be managing it.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Consider Controlled folder access for important files
Controlled folder access helps stop unknown or untrusted apps from changing files in protected folders. Windows commonly protects Documents, Pictures, Videos, Music, and Desktop; you can also add folders. This can be useful for files you particularly want to guard against unwanted changes, but it may interrupt an app that needs to write there.
- In Windows Security, open Virus & threat protection.
- Under Ransomware protection, select Manage ransomware protection.
- Turn on Controlled folder access, if the setting is available.
- Use your usual apps and workflows. If a legitimate app is blocked, verify that it is the expected app and that you launched it from the expected location.
- Only then use the option to allow an app through Controlled folder access. Allow only apps you trust, and only when needed.
An allowed app can access protected folders. If that app is compromised, the access you granted could put files at risk. Avoid allowing an app simply because a prompt appeared; confirm its identity first.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review reputation-based protection and PUA blocking
Potentially unwanted applications (PUAs) are not necessarily malware. They can, for example, show unwanted ads, slow a PC, or offer additional software. Microsoft says PUA protection has been on by default since early August 2021, so check your own setting rather than assuming it is off or on.
In Windows Security, open App & browser control and select Reputation-based protection settings, if shown. Review the options for blocking apps and downloads. Microsoft recommends enabling both in its Windows 10 configuration guidance. Download blocking works with Microsoft Edge; app blocking can detect a PUA that has already been downloaded or installed.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Understand Smart App Control on Windows 11
Smart App Control is a Windows 11-specific feature that uses a cloud-powered service to assess apps. Apps judged safe can run, while apps judged malicious or potentially unwanted can be blocked. If the service cannot make a confident prediction, it checks the app’s signature and blocks an app with an unsigned or invalid signature.
Recommended Free Tools
Because the feature can block apps, it may affect whether you can run software you need. Check the app’s source and legitimacy before acting on a block; do not treat a blocked app as proof that it is malicious, or bypass the warning without verifying it.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Know what the other Windows Security areas do
Windows Security’s overview contains separate protection areas. They are not one combined toggle, and each addresses a different risk.
- Firewall & network protection: Review firewall settings for domain, private, and public network profiles.
- App & browser control: Includes SmartScreen, exploit protection, and PUA controls.
- Device security: Provides access to security features available on your device.
- Protection history: Shows protection actions and notifications for review.
Be cautious with exclusions and real-time protection
Turning off real-time protection means opened or downloaded files are not scanned until protection returns. An exclusion also stops real-time scanning of the selected item. Microsoft warns that exclusions can put your device and data at risk, so avoid using them as a routine workaround for an alert or compatibility problem.
Cloud-delivered protection uses an internet connection to receive updated improvements. Automatic sample submission may send suspicious files to Microsoft for analysis. Review these options in Virus & threat protection settings if you want to understand how they are configured on your PC.
Free tools Windows power users keep installed
One-click scans. No signup required.
If a compatible non-Microsoft antivirus program is installed, Microsoft says it automatically turns Microsoft Defender Antivirus off. That does not mean every separate Windows Security area is the same control; check the status of the feature you intend to use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
