Best Windows Security Features in 2026: Complete Guide
A practical, up-to-date tour of the Windows 11 security features that matter most: what each one does, where to switch it on, and how to verify it with PowerShell. Updated in October 2026 for the Secure Boot certificate change and current support dates.
Security that starts at the chip and ends in the cloud
The best Windows Security features in 2025 are the ones that work together: Microsoft Defender Antivirus for everyday malware, Smart App Control and ransomware protection for risky files, memory integrity and Secure Boot for hardware-backed defense, BitLocker for stolen devices, and Windows Hello for passwordless sign-in.
Verify the defaults
Most protections are already built in. The real work is confirming they are on and healthy.
Layer hardware and identity
Combine memory integrity, Secure Boot, BitLocker and Windows Hello so one failure does not expose everything.
Stay on supported builds
Protections only help on supported Windows versions, so track the end-of-support dates below.
1. What is Windows Security and why it matters in 2025
The Windows Security app is the single place in Windows 11 where you manage antivirus, ransomware controls, firewall, app and browser protection, device hardening and account protection. Behind it sit deeper platform features such as virtualization-based security, Secure Boot and the TPM.
Microsoft describes Windows 11 as secure by design and secure by default, with hardware requirements such as TPM 2.0 that make protections far more consistent than they were on Windows 10. That is why this list leans on features that are tied to the hardware baseline.
Open the app any time with Start > Windows Security, or from Settings > Privacy & security > Windows Security.
2. Windows Security features at a glance
| Feature | Protects against | Where to find it | Default |
|---|---|---|---|
| Microsoft Defender Antivirus | Malware, viruses, spyware | Virus & threat protection | On |
| Smart App Control | Untrusted and unsigned apps | App & browser control | Evaluation, device dependent |
| Controlled folder access | Ransomware changing files | Ransomware protection | Off |
| Memory integrity | Malicious kernel drivers | Device security > Core isolation | On for new, compatible installs |
| Secure Boot | Bootkits and boot-level malware | Device security > Secure Boot | On with UEFI |
| BitLocker / device encryption | Data theft from lost devices | Settings > Device encryption | Auto on clean install with a Microsoft or work account |
| Windows Hello and passkeys | Password theft and phishing | Settings > Accounts > Sign-in options | User enrolled |
| Administrator protection | Silent privilege abuse | Policy / Intune | Off, rolling out |
| Quick Machine Recovery | Boot failures | Windows Recovery Environment | Auto on for unmanaged Pro and Home |
| Built-in Sysmon | Monitoring blind spots | Optional features | Off |
3. Feature 1: Microsoft Defender Antivirus
Your always-on baseline
Microsoft Defender Antivirus ships inside Windows and runs real-time protection with cloud-delivered intelligence. It needs no extra license and updates through Windows Update. Tamper protection stops malware and careless scripts from switching Defender off.
# Run in an elevated PowerShell window
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated
Update-MpSignatureExpected result: the first three values show True and the signature date is recent.
Why: if you run a third-party antivirus, Windows Security shows that product as active and Defender steps back. That is normal and not a fault.
4. Feature 2: Smart App Control
Block untrusted apps before they run
Smart App Control asks Microsoft’s cloud security service whether it can confidently predict that an app is safe. If it cannot, it checks for a valid signature, and unsigned or badly signed apps are blocked. It starts in evaluation mode and blocks nothing while Windows decides whether your usage is a good fit.
Earlier guidance said it needed a clean install. Microsoft’s current support documentation says recent updates let you turn it on, and back on, without reinstalling when it is available for your device. It is not available on Windows 10, and there is no per-app bypass.
# 0 = off, 1 = on, 2 = evaluation mode
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" | Select-Object VerifiedAndReputablePolicyState5. Feature 3: Ransomware protection
Controlled folder access and data recovery
The Ransomware protection page has two jobs: stop the attack and help you recover. Controlled folder access lets only trusted apps change files in protected folders such as Documents, Pictures and Desktop, so ransomware cannot encrypt them. The page also offers ransomware data recovery, which relies on your OneDrive backup.
# Audit first: log what would be blocked without blocking it
Set-MpPreference -EnableControlledFolderAccess AuditMode
# When you are happy with the results, enforce it
Set-MpPreference -EnableControlledFolderAccess Enabled
Get-MpPreference | Select-Object EnableControlledFolderAccessExpected result: the value shows 2 for audit mode and 1 when enabled.
6. Feature 4: Core isolation and memory integrity
Hardware-backed protection for the kernel
Windows 11 uses virtualization-based security (VBS) to place sensitive parts of the system behind a hardware boundary. Memory integrity, also called hypervisor-protected code integrity (HVCI), only lets verified drivers run in the kernel. Microsoft has stated that VBS, Credential Guard, the vulnerable driver blocklist and LSA protection are enabled by default on Windows 11 on supported devices, which makes credential theft much harder.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunningExpected result: VirtualizationBasedSecurityStatus is 2 (running). In SecurityServicesRunning, a 1 means Credential Guard and a 2 means memory integrity.
Why: if memory integrity will not turn on, an old incompatible driver is the usual cause. Windows lists it so you can update or remove it. Do not force the feature off to silence the warning.
7. Feature 5: Secure Boot and TPM 2.0
Protection before Windows starts
Secure Boot makes sure only trusted software loads during startup, which defeats bootkits. Windows 11 requires TPM 2.0 and Secure Boot capable hardware, so these protections are available on nearly every supported PC.
Confirm-SecureBootUEFI
Get-Tpm | Select-Object TpmPresent, TpmReady
# Check whether the 2023 Secure Boot certificate is present
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes) -match "Windows UEFI CA 2023"Expected result: True for Secure Boot, True for the TPM values, and True for the certificate check once your PC has the new certificate.
The 2026 Secure Boot certificate change
This is the update most 2025 articles missed. The Secure Boot certificates shipped since 2011 expire in stages: the Microsoft KEK CA 2011 on June 24, 2026, the Microsoft UEFI CA 2011 on June 27, 2026, and the Windows Production PCA 2011 on October 19, 2026. Microsoft is replacing them with 2023 certificates through Windows Update. PCs keep booting, but a device that has not received the new certificates falls into a degraded security state.
8. Feature 6: BitLocker device encryption
Keep data private on lost or stolen laptops
With Windows 11 24H2, Microsoft lowered the hardware requirements for automatic device encryption, so more devices, including Home editions, can use it. It turns on automatically during a clean install or reset when you sign in with a Microsoft account or a work or school account, and the recovery key is backed up to that account.
Get-BitLockerVolume -MountPoint "C:" | Select-Object VolumeStatus, ProtectionStatus, EncryptionPercentage
manage-bde -protectors -get C:Expected result: VolumeStatus is FullyEncrypted and ProtectionStatus is On, with a recovery password protector listed.
9. Feature 7: Windows Hello and passkeys
Passwordless sign-in tied to the device
Windows Hello pairs your face, fingerprint or PIN with the TPM, so the credential never leaves the device. Combined with passkeys, it removes the stolen-password problem behind most phishing. Recent Windows 11 releases extend this with plugin credential managers that support passkeys and security-key PIN setup, and with Enhanced Sign-in Security support for compatible external fingerprint readers.
# On a work or school device, look for NgcSet : YES under User State
dsregcmd /statusWhy: for businesses, pair Windows Hello for Business with Microsoft Entra ID so users sign in without passwords across Microsoft 365 and other apps.
10. Feature 8: Administrator protection
A guardrail for admin rights
Administrator protection fixes a classic weakness: an administrator account that is always elevated. With it enabled, an action that needs admin rights requires verification through Windows Hello, and the elevation uses just-in-time privileges with a separate profile for admin tasks. That helps stop malware from making silent system changes.
It was announced at Ignite 2024, appeared in a preview cumulative update in October 2025, and is reported as part of the Windows 11 26H2 feature set.
11. Feature 9: Quick Machine Recovery and hotpatch
Security through resilience
Quick Machine Recovery (QMR) extends the Windows Recovery Environment so a PC that cannot boot can fetch a fix through Windows Update. Since February 2026, QMR turns on automatically for Windows Pro devices that are not domain-joined and not enrolled in enterprise endpoint management, matching what Home users already get.
Hotpatch installs critical security updates without a restart. Per reporting on the 25H2 release, it needs an eligible license (Windows 11 Enterprise E3, E5 or F3, Education A3 or A5, or Windows 365 Enterprise) and virtualization-based security enabled. Fewer reboots mean updates land sooner, which is a real security gain.
12. Feature 10: Built-in Sysmon
Better visibility for defenders
Windows now includes System Monitor (Sysmon) functionality natively. It records detailed process, network and file events to the Windows Event Log and supports custom configuration. It is off by default.
Why: forward these events to your SIEM or Microsoft Sentinel to improve threat hunting without deploying a separate Sysinternals package.
13. Windows support status
Windows 10
Standard support ended on October 14, 2025. Microsoft extended free Extended Security Updates for consumers until October 2027, according to BleepingComputer. Treat that as a bridge, not a plan.
Windows 11 24H2 Home and Pro
End of updates was October 13, 2026. Move to 25H2 or 26H2. Enterprise and Education editions stay supported until October 12, 2027.
Windows 11 23H2
Home and Pro stopped receiving security updates in November 2025.
Windows 10 LTSB 2016
Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB reached end of support on October 13, 2026.
14. Hardening checklist
- Turn on Real-time protection, Cloud-delivered protection and Tamper protection.
- Enable memory integrity and resolve any incompatible driver it reports.
- Verify Secure Boot status, including the new certificate message.
- Confirm BitLocker or device encryption is on and the recovery key is stored safely.
- Set up Windows Hello and passkeys, and remove passwords where you can.
- Enable controlled folder access after testing your key apps in audit mode.
- Try Smart App Control on personal PCs that do not run unsigned tools.
- Install updates promptly and move off unsupported Windows versions.
15. Best practices for IT administrators
- Manage Defender, BitLocker and Windows Hello for Business centrally with Intune or Group Policy instead of per-device settings.
- Back up BitLocker recovery keys to Microsoft Entra ID or Active Directory, and test a recovery before you need it.
- Inventory BIOS and firmware versions now, because Secure Boot certificate updates can depend on OEM firmware.
- Pilot controlled folder access and App Control policies in audit mode on a small ring first.
- Plan Administrator protection, hotpatch eligibility and Sysmon log collection into your next Windows 11 rollout.
- Combine endpoint controls with identity hardening. Local admin passwords are covered in the Windows LAPS setup guide.
16. FAQ
Is Windows Security enough, or do I need third-party antivirus?
For most home users and many businesses, Microsoft Defender Antivirus with the other built-in protections is a solid baseline. Organizations with specific compliance needs may add an endpoint detection and response product, which works alongside or in place of Defender.
Is Smart App Control available on Windows 10?
No. Smart App Control is a Windows 11 feature and is not available on Windows 10.
Does Windows 11 encrypt my drive automatically?
On a clean install or reset of 24H2 or later, device encryption turns on automatically when you sign in with a Microsoft account or a work or school account. It does not retroactively encrypt an existing PC upgraded through Windows Update, and local accounts do not trigger it.
What happens if my Secure Boot certificates are not updated?
The PC still starts, but it is in a degraded security state and may miss future boot-level protections. Check Windows Security > Device security > Secure Boot, install current Windows and firmware updates, and follow Microsoft’s guidance if the status shows a warning.
Which Windows Security features matter most for ransomware?
Layer Defender real-time protection, controlled folder access, memory integrity, regular updates and OneDrive or offline backups. No single switch stops every attack, so recovery planning matters as much as prevention.
Conclusion
- Reviewed the ten Windows Security features that deliver the most protection in 2025.
- Learned where to enable each one and how to verify it with PowerShell.
- Checked the 2026 Secure Boot certificate change and current Windows support dates.
- Built a hardening checklist you can apply to a single PC or a whole fleet.
Key takeaway: the strongest Windows setup combines hardware-backed protections, passwordless sign-in, ransomware controls and fast recovery. Most of it is already in Windows 11, so start by verifying what is switched on.
Keep building your Windows and security skills
Explore more practical guides on Windows Server, Active Directory, Azure and Microsoft 365.
Explore more tutorials →Related VMoreCloud security tutorials
Windows LAPS on Windows Server 2025
Secure local administrator passwords, configured per forest.
Configure a forest trust on Windows Server 2025
Harden cross-forest access with SID filtering and selective authentication.
Deploy an RODC and configure Password Replication Policy
Limit credential exposure in branch offices.
Sources & Further Reading
- Microsoft Learn: Windows 11 Security Book (2025 edition)
- Microsoft Support: App & browser control in the Windows Security app
- Microsoft Support: Smart App Control FAQ
- Microsoft Support: Ransomware protection in Windows Security
- Microsoft Support: Windows Secure Boot certificate expiration
- BleepingComputer: Windows 11 KB5067036 and Administrator protection
- Petri: Ignite 2024, Windows 11 hotpatching and Admin Protection
- Tom’s Hardware: Windows 11 24H2 BitLocker defaults
Technical note: Windows Security features, defaults and availability vary by Windows edition, build, license and device hardware. Commands are shown for an elevated PowerShell window. Test changes on a pilot device before deploying them broadly, and always keep BitLocker recovery keys backed up.