After a 7-year corporate stint, Tanveer found his love for writing and tech too much to resist. An MBA in Marketing and the owner of a PC building business, he writes on PC hardware, technology, and Windows. When not scouring the web for ideas, he can be found building PCs, watching anime, or playing Smash Karts on his RTX 3080 (sigh).
Unlike your desktop, your laptop is exposed to several threat vectors simply because it leaves the safety of your home, giving attackers many more ways to steal it or compromise your data. That's not to say that you shouldn't enable basic security settings on your desktop, but they become way more critical on your Windows laptop.
While some security settings are enabled by default on a new Windows 11 installation, you have to manually opt in to others. By enabling them, you effectively make it harder for attackers to threaten or steal your data even if they gain control of your machine. They'll also help if someone intends to mess with your data or settings when your laptop is unattended.
Controlled folder access
Prevent unauthorized data encryption and deletion
I'm assuming your laptop doubles up as your work machine and possibly stores some of your financial information, too. Even if it doesn't leave the house, it can still get caught up in a ransomware attack. Attackers routinely use unassuming entry points like phishing emails, malicious websites, and pirated media to inject ransomware into thousands of machines. Your unprotected folders can be held for ransom before you know what happened.
Although Windows Security protects against ransomware and other types of security attacks, enabling Controlled folder access (CFA) can provide your data with an additional layer of protection. Even if a new ransomware strain bypasses the default security controls, CFA will prevent it from modifying your files, since it will not have the necessary permissions. CFA will block the attacks and notify you of the same.
It also protects critical boot sectors from boot-level ransomware, so attackers can't lock you out of the entire OS. You can toggle CFA on by navigating to Settings > Privacy & security > Windows Security > Virus & threat protection > Manage ransomware protection, or simply searching for it in the search bar. By default, CFA protects folders like Documents, Pictures, Music, and Videos, but you can add any other folder you want to protect.
Dynamic lock
Automatically lock your device when you walk away
If you aren't in the habit of manually locking your laptop in a library or café when walking away for a glass of water or a bio break, anyone can gain access to your unattended device. It doesn't have to be a determined attacker after your sensitive data. It could simply be a prying stranger or even a friend intent on causing mischief. Your screen lock settings might take too long to lock your laptop, so enabling Dynamic lock can provide a backup layer of protection.
Enabling it requires pairing your laptop with your smartphone, so that Windows can detect when you've left your device unattended. It monitors the Received Signal Strength Indicator (RSSI) of your phone's Bluetooth connection, waiting for it to drop below a certain threshold. It waits for about 30 to 60 seconds before locking your laptop, preventing unauthorized access. You can find Dynamic lock at Settings > Account > Sign-in options > Dynamic lock.
Although the physical environment around the laptop can influence the distance needed to trigger the lock, this is still a useful setting to enable. Note that someone can still access your device within the 30-to-60-second grace period.
Device encryption
Hide your data from prying eyes
Most new Windows laptops have device encryption enabled by default, but you may have disabled BitLocker on your laptop for fear of a performance penalty. However, the benefits of BitLocker easily outweigh any negligible performance impact it might have on a modern laptop. Features like CFA can protect your data from unauthorized modification, but Full Disk Encryption (FDE) protects your entire drive.
Without the decryption key, nobody can access the data on your drive. If an attacker removes your hard drive or SSD from the laptop and plugs it into another computer, they can't make sense of the data without the BitLocker Recovery key. You can enable device encryption at Settings > Privacy & security > Device encryption.
Attackers can obviously erase a stolen drive or laptop and sell it to make some cash, but FDE ensures your data remains safe from unauthorized access.
Tamper Protection
Who will guard the guards?
Each of the settings above involves setting up an additional security layer to protect your data, but what if someone disables the said security controls themselves? Malware is sophisticated enough to take control of your laptop by slowly dismantling your security settings. All of your carefully curated security features will do nothing if malware manages to disable them.
This is why enabling Tamper Protection is essential, not just on laptops but even on desktops. This feature stops apps and processes from making any changes to your machine's security infrastructure. While you, as an administrator, can still tweak your security settings, any app pr process is blocked. You can toggle Tamper Protection on at Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings (under Virus & threat protection settings).
Enable these security settings on a new Windows laptop
Microsoft's built-in security settings have gotten fairly robust over time, so much so that many users don't use third-party protection at all. When you're setting up a new laptop, many of these settings are pre-enabled, but you still need to turn others on. These settings will protect your laptop both inside and outside your house by preventing attackers from gaining unauthorized access or disabling the security features themselves.