How to Protect Your Windows 11 PC from Viruses

Hardware-Level Security: The Foundation

Windows 11 stops many threats before they start by using dedicated hardware. Built-in components like TPM 2.0 (Trusted Platform Module, a secure crypto processor chip) and Microsoft Pluton protect encryption keys in hardware instead of leaving them in files on the drive. This makes it much harder for attackers to bypass your login or steal sensitive data.

Windows 11 requires TPM 2.0, so most PCs that run it already have it switched on. To check, and to turn it on if it is off, follow these steps:

1. Open Settings › Privacy & security › Windows Security.
2. Click Device security. If you see a Security processor section, your PC has a TPM. Click Security processor details to confirm the specification version reads 2.0.
3. If there is no Security processor section, the TPM is probably turned off in the BIOS/UEFI (the firmware settings that load before Windows). Restart the 🔄 PC and open the firmware setup. The key is usually Delete, F2 or F10, depending on the manufacturer.
4. Look in the security or advanced settings for an option named TPM, Intel PTT (Intel PCs) or AMD fTPM (AMD PCs). Enable it, then save and exit.

Menu names differ between manufacturers, so check your motherboard or PC manual if you can’t find the option. Don’t change other firmware settings while you are there.

Is Windows Defender Enough for a Home User?

For most users, Microsoft Defender is highly effective. It provides real-time protection, behavioral monitoring, and cloud-based scanning. Because it is built into the operating system, it is tuned for performance and won’t conflict with system updates.

It is on by default, but it is worth confirming that it is running and that it has scanned recently:

1. Open Settings › Privacy & security › Windows Security, then click Virus & threat protection.
2. Check the status under Current threats. A green check mark means no action is needed.
3. Click Manage settings under Virus & threat protection settings and make sure Real-time protection and Cloud-delivered protection are set to On.
4. Go back and click Quick scan to run a scan now. For a deeper check, click Scan options, choose Full scan and click Scan now. A full scan can take a long time, so start it when you don’t need the PC.

If a setting is greyed out or the page says your settings are managed, another antivirus program or an organization’s policy is in control. Real-time protection can also switch itself off for a short time if you turn it off by hand, so turn it back on when you finish.

Does 🪟 Windows 11 Need Third-Party Antivirus Software?

Generally, no. Windows Security provides comprehensive endpoint protection that rivals paid software. Unless you have specific enterprise needs, the built-in tools defend against modern malware and phishing attacks.

If you do install a third-party antivirus, Windows detects it and turns off Microsoft Defender Antivirus’s real-time protection so the two don’t fight each other. If you uninstall that program later, Defender takes over again. Never run two real-time antivirus programs at once. They slow the PC and can cause errors.

Smart App Control: A New Layer of Defense

Smart App Control acts as a digital bouncer for Windows 11, blocking untrusted or potentially dangerous apps before they run. It uses Microsoft’s cloud intelligence to judge whether an app is safe, and it blocks apps that are unsigned or have no good reputation.

To check or change it:

1. Open Settings › Privacy & security › Windows Security.
2. Click App & browser control, then click Smart App Control settings.
3. Choose On to block untrusted apps. Evaluation mode watches how you use the PC and turns itself on or off on its own. Off disables the feature.

Smart App Control is only available on new installs of Windows 11 version 22H2 or later. On a PC upgraded from an older setup, the option may be missing or greyed out. On many builds, turning it off means you can’t turn it back on without resetting or reinstalling Windows, so think before you switch it off. Recent updates have relaxed this on some builds. If it blocks a program you trust, check whether the publisher has a newer, signed version before you disable the feature.

Controlled Folder Access for Ransomware Protection

Ransomware encrypts your files and demands payment. Controlled Folder Access prevents unauthorized programs from changing files in your protected folders. Requires administrator privileges: you must be signed in with an administrator account, or enter an admin password when asked. The setting is available in Home and Pro.

1. Open Settings › Privacy & security › Windows Security.
2. Click Virus & threat protection.
3. Under Ransomware protection, click Manage ransomware protection.
4. Turn on Controlled folder access. Click Yes if User Account Control asks for permission.
5. Click Protected folders to see which folders are covered. Documents, Pictures, Videos, Music and Desktop are protected by default. Click Add a protected folder to include others.

Controlled Folder Access can block a legitimate program that tries to save into a protected folder, and you will see a notification when that happens. To allow the program, click Allow an app through Controlled folder access and add it. To undo the whole feature, return to the same page and turn the toggle off. Pairing it with backups, such as OneDrive or an external drive, gives you a way to recover if something does get through.

Identity and Access Management

Consider using Windows Hello for biometric login (like fingerprint or facial recognition) instead of typing traditional passwords. For even better security, use Passkeys. These replace traditional passwords with cryptographic keys, which makes it very hard for hackers to steal your credentials through phishing, because there is no password to type into a fake site.

1. Open Settings › Accounts › Sign-in options.
2. Pick a method, such as Facial recognition (Windows Hello), Fingerprint recognition (Windows Hello) or PIN (Windows Hello), and click Set up.
3. Follow the prompts. You will confirm your current password first, then enroll your face, fingerprint or PIN.

Face and fingerprint options only appear if your PC has a compatible camera or reader. The PIN option works on any PC, and it is stored on the device, not sent to the internet. Passkeys are created at the website or app that supports them, and you approve them with Windows Hello. On recent Windows 11 builds you can also manage saved passkeys in Settings › Accounts › Passkeys.

Summary

To protect Windows 11 from viruses and malware, you need a mix of built-in security tools, regular system updates, and hardware-level safeguards. This guide shows you how to confirm TPM 2.0 is active (and turn it on in your BIOS if needed), block unsafe software with Smart App Control, and protect your personal files with Controlled Folder Access so malicious programs cannot lock or delete your data.

For updates, open Settings › Windows Update and click Check for updates. Install what it finds and restart when asked, because many security fixes only take effect after a restart. Leave automatic updates on so you don't have to remember.

• Enable Hardware SecurityEnsure TPM 2.0 is active in your BIOS.
• Use Smart App ControlKeep this enabled to block suspicious software.
• Activate Ransomware ProtectionTurn on Controlled Folder Access.
• Update RegularlyAlways install the latest Windows updates to patch security holes.
• Use Modern LoginSwitch to Windows Hello or Passkeys.