Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The highest-impact IAM changes are to require multifactor authentication (MFA), make phishing-resistant FIDO/WebAuthn the preferred method, restrict administrator privileges, secure recovery and authenticator enrollment, alert on sensitive changes, and limit session persistence according to risk. These controls make takeover and fraudulent recovery harder, but no setting guarantees that an account cannot be compromised.
Apply the controls in this order: protect administrators and other high-value accounts first; remove unnecessary privilege; then standardize recovery, session, password and monitoring policies across the remaining population. The exact menus and available options depend on the identity service.
Start with MFA, and aim for phishing resistance
MFA blocks many password-only attacks by requiring an additional factor. CISA recommends starting with administrator accounts, email, remote-access systems and services containing sensitive information, then extending MFA to other accounts. Rollout should include enrollment support and a recovery plan so users do not bypass the control when they lose a device.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Which MFA method is phishing-resistant?
FIDO2/WebAuthn authenticators, including platform passkeys and compatible hardware security keys, are designed to bind the authentication response to the legitimate site. A physical key can be a strong option where the service and the user’s devices support it; compatibility is not universal, so verify support before making it the only method.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CISA ranks physical security keys among the strongest MFA options and identifies FIDO/WebAuthn as phishing-resistant. By contrast, a code generated by an app or delivered by text or email can be entered into a phishing site and replayed. Ordinary push approvals can also be abused by sending repeated unsolicited prompts until a user accepts one. If phishing-resistant authentication is unavailable, number matching is a more defensible interim choice than an uncontextualized push approval.
CISA states: “One-time passwords, whether generated in an app or hardware token or delivered through SMS, e-mail, or some other out-of-band method, do not protect against phishing unless they are combined with some other phishing-resistant technology such as mutual TLS authentication.” OTPs can still stop a password-only compromise, but they are not themselves phishing-resistant. See CISA’s Identity and Access Management recommended practices, CISA’s MFA guidance and CISA’s “More than a Password” advice.
Compare available methods before enforcing one
| Method | Phishing resistance | Enrollment and recovery considerations | Dependencies |
|---|---|---|---|
| FIDO/WebAuthn passkey or security key | Phishing-resistant when implemented correctly | Register more than one authenticator; keep a secure spare or another approved recovery method | Service, browser, operating system and device must support FIDO/WebAuthn |
| Number-matched push | Stronger interim protection than an uncontextualized push approval, but not the target state | Users need the enrolled push device; provide a documented lost-device process | Push-capable phone or device and provider support |
| Authenticator-app one-time code | Not phishing-resistant; a phishing site can capture and replay the code | Back up enrollment or provide recovery codes; protect the phone | Authenticator app and device access |
| SMS or email one-time code | Not phishing-resistant and dependent on the phone number or inbox | Use as fallback only; do not make a potentially compromised inbox the sole route for a high-value account | Mobile service or email access |
Roll out MFA without creating bypasses
- Inventory accounts and classify administrators, email users, remote-access users and systems holding sensitive data.
- Require MFA for administrators and high-value services first, with a tested break-glass process that is tightly monitored and rarely used.
- Prefer FIDO/WebAuthn. Where it is unavailable, use number matching or another available method while planning a phishing-resistant upgrade.
- Enroll at least two authenticators for important accounts when the service permits it, so losing one device does not force a risky recovery.
- Communicate that unsolicited prompts should be denied and reported. Never ask users to approve a prompt they did not initiate.
- After enrollment, test sign-in, device loss and recovery with a non-production account before enforcing the policy broadly.
Keep privileged access narrow and separate
Least privilege limits what an attacker can do after compromising an ordinary account. Use role-based access control with defined permissions, remove accounts that are no longer needed, and review whether each assignment still has a business purpose. Limit the number of people who can administer systems.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Separate daily and administrative identities
Where the platform allows it, give administrators a dedicated administrative account and a separate account for email, browsing and routine work. The administrative identity should not be used for general web activity. Require stronger authentication and shorter sessions for administrative access than for low-risk tasks.
Review privilege on a schedule and after changes
- Record who owns each role and what systems it can change.
- Remove dormant, duplicate and departing-user accounts promptly.
- Check group memberships, delegated permissions, service accounts and emergency accounts.
- Require approval for new privileged access and a time-bounded end date where practical.
- Revoke access when a person changes role, leaves the organization or no longer needs the resource.
CISA’s communications-infrastructure hardening guidance and its administrator recommendations both emphasize limiting administration and assigning roles with defined permissions. Reducing standing privilege narrows the damage an everyday account can cause.
Make account recovery harder to abuse
Recovery is an alternate authentication path, so it must receive the same security attention as normal sign-in. NIST SP 800-63B-4 describes saved recovery codes, issued recovery codes, recovery contacts and repeated identity proofing as possible methods. The appropriate combination depends on the service’s assurance level and implementation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use more than one authenticator
Registering multiple authenticators reduces dependence on recovery when one device is lost. For a high-value account, keep a second FIDO authenticator or another provider-approved method in a secure location. Do not store recovery codes in the same unlocked device or password file that an attacker could already access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Understand the NIST AAL2 recovery combinations
For accounts operating at Authentication Assurance Level 2 (AAL2), NIST specifies qualifying paths such as two recovery codes from different methods, one recovery code together with an already-bound single-factor authenticator, or repeated identity proofing where available. These are requirements for covered digital identity services, not a universal recipe for every consumer account; a particular service may use a different process.
Protect the recovery channel
- Do not make an easily compromised email inbox or phone number the sole recovery route for a high-value account.
- Store printed or offline recovery codes where they are protected from unauthorized access, fire and casual discovery.
- Review recovery contacts and devices whenever the account’s security settings are changed.
- Prefer recovery procedures that verify more than possession of a single email address or phone number.
NIST requires notification after recovery. Its standard states: “An account recovery event always causes one or more notifications to be sent to the subscriber to help detect the fraudulent use of account recovery.” The requirement appears in NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025, section 4.2).
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect authenticator enrollment and security-setting changes
An attacker who adds their own authenticator can survive a password reset and continue using the account. Treat adding, replacing or removing an authenticator as a sensitive event. Require the strongest available reauthentication before allowing the change, and do not let a newly added factor immediately authorize its own enrollment without an independent check when the service supports stronger sequencing.
What users should review
- Registered passkeys, security keys, phones and authenticator applications.
- Recovery email addresses, phone numbers, contacts and generated codes.
- Recent sign-ins, active sessions and devices.
- Rules that forward email or grant application access, if the account service exposes them.
Enable alerts for authenticator enrollment, recovery, password changes and other security-setting changes when the provider offers those alerts. Not every service exposes each control, so document what is available and compensate with monitoring where it is not.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSet session expiry according to role and exposure
A stolen session token can let an attacker bypass the password and MFA until the token expires or is revoked. Limit session-token duration and require reauthentication after expiry. There is no universal correct number of minutes: choose a duration based on the account’s privilege, data sensitivity, device trust, remote exposure and the operational cost of repeated sign-ins.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
| Account context | Session policy direction | Reason |
|---|---|---|
| System administrators and other privileged roles | Shorter sessions, frequent reauthentication and rapid revocation on risk signals | High impact if a token is stolen |
| Remote access to sensitive systems | Short or risk-adaptive sessions; reauthenticate after inactivity or context change | Greater exposure outside the managed network |
| General workforce accounts | Balance reasonable expiry with device and sign-in risk; revoke sessions after security events | Lower privilege but broad user count |
| Low-risk personal services | Use the provider’s available controls and sign out shared or lost devices | Consumer services may expose fewer policy options |
Use sound password controls alongside MFA
Require unique passwords and encourage a reputable password-management tool to generate and store them. A password manager complements MFA; it does not replace it. Change a password when it is compromised, exposed, shared improperly or otherwise requires replacement. CISA cautions that routine forced rotation can encourage predictable patterns, so frequent calendar-based changes are not a substitute for stronger authentication.
Build a role-based IAM baseline
Apply settings according to privilege and sensitivity rather than giving every account identical convenience settings.
| Control | Administrators | Users handling sensitive data | Other users |
|---|---|---|---|
| MFA method | Require FIDO/WebAuthn where supported; maintain an approved backup | Require MFA, prioritizing phishing-resistant methods | Require MFA and migrate weaker methods over time |
| Privilege | Dedicated admin identity, least privilege and periodic review | Only permissions needed for the role | Default-deny access to sensitive systems |
| Recovery | Multiple authenticators, protected codes and monitored recovery | More than one approved recovery path | Provider-supported recovery with alerts enabled |
| Sessions | Shorter expiry and reauthentication | Risk-based expiry | Practical expiry with sign-out on shared or lost devices |
| Monitoring | Alert on sign-ins, privilege and authenticator changes | Alert on recovery and security-setting changes | Alert on unusual sign-ins and account changes where available |
Implementation checklist and common failure modes
Checklist
- List every identity provider, administrator account, remote-access path and sensitive application.
- Enable MFA for administrators, email, remote access and sensitive systems.
- Replace SMS, email and ordinary push approval with FIDO/WebAuthn where supported; use number matching as an interim measure when necessary.
- Separate administrative accounts from ordinary accounts and remove unnecessary privilege.
- Register multiple authenticators and protect recovery codes and contacts.
- Turn on notifications for recovery and security-setting changes.
- Set session duration and reauthentication by role, device and data sensitivity.
- Adopt unique passwords and event-driven password changes.
- Test lost-device recovery, authenticator replacement, session revocation and emergency access.
- Review the policy after organizational, application or threat changes.
Failure modes to avoid
- Equating all MFA with phishing resistance: OTP and push methods can still be phished or socially engineered.
- Leaving recovery weaker than sign-in: an email-only reset can undo a strong MFA policy.
- Giving everyone administrator rights: one compromised account then has unnecessarily broad reach.
- Using one authenticator: loss of that device forces an avoidable emergency recovery.
- Setting one timeout for every role: convenience-oriented sessions may be too long for privileged access, while very short sessions can drive unsafe workarounds.
- Relying on forced password rotation: predictable suffix changes do not address phishing or stolen sessions.
- Ignoring enrollment alerts: an attacker’s newly registered authenticator can provide persistent access.
These settings reduce likelihood and impact; they do not eliminate compromise. Keep incident procedures ready to revoke sessions, remove unauthorized authenticators, reset credentials, review privilege and investigate recovery notifications.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
