Ransomware attacks have become a daily headline, and the good news is you don’t need expensive third‑party suites to keep your Windows PC safe. In this guide we’ll walk you through every built‑in Windows feature that can stop ransomware in its tracks, from the ever‑present Microsoft Defender to BitLocker encryption. By the end you’ll have a hardened machine that still feels familiar to use.
What You’ll Need
- A PC running Windows 10 (version 1903 or later) or Windows 11
- Administrator rights on the computer
- An internet connection for updates
- A USB flash drive (optional, for BitLocker recovery key)
- Basic comfort with navigating Windows Settings and PowerShell
Step 1: Keep Windows Updated
Microsoft constantly releases patches that close the vulnerabilities ransomware exploits. Open Settings > Windows Update and click Check for updates. Install everything, then enable Automatic updates so you never miss a critical fix. If you prefer PowerShell, run:
powershell -Command "& {Get-WindowsUpdate -Install -AcceptAll}" Common mistake: disabling “Restart notifications” thinking it saves time. Ransomware can strike while you’re running an outdated kernel, so always let Windows reboot after updates.
Step 2: Turn On Microsoft Defender Antivirus
Windows ships with a robust, low‑impact antivirus engine. Go to Settings > Privacy & Security > Windows Security > Virus & threat protection and ensure Real‑time protection is toggled on. For extra confidence, enable Cloud‑delivered protection and Automatic sample submission. You can also verify the status via PowerShell:
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, CloudProtectionEnabled
Common mistake: turning off Defender to “improve performance.” Modern Windows machines handle Defender with negligible overhead, and disabling it opens a direct line for ransomware.
Step 3: Activate Controlled Folder Access
Controlled Folder Access (CFA) is a ransomware‑specific feature that only allows trusted apps to modify files in protected folders (like Documents, Pictures, Desktop). Enable it by navigating to Windows Security > Virus & threat protection > Manage ransomware protection and switching Controlled folder access to On. Add folders you want to protect (the defaults are a good start) and then whitelist apps you trust:
powershell -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:Program FilesMicrosoft OfficerootOffice16WINWORD.EXE'"
Common mistake: forgetting to add legitimate productivity apps (e.g., Photoshop, VS Code). When a trusted app is blocked, Windows will show a notification—use it to quickly add the app to the allowed list.
Step 4: Enable BitLocker Drive Encryption
Even if ransomware encrypts your files, BitLocker can protect the entire drive from being accessed without proper authentication, especially on stolen laptops. Open Control Panel > BitLocker Drive Encryption, click Turn on BitLocker for your system drive, and follow the wizard. Choose a strong password or a TPM‑only mode if your hardware supports it. When the wizard asks for a recovery key, save it to a USB stick and also upload it to your Microsoft account.
manage-bde -on C: -RecoveryPassword
Common mistake: storing the recovery key on the same encrypted drive. If the drive fails, you’ll lose both data and the key. Always keep the key off‑device.
Step 5: Configure Windows Defender Firewall
The built‑in firewall blocks inbound traffic that could deliver ransomware payloads. Go to Windows Security > Firewall & network protection and ensure the firewall is turned on for all network profiles (Domain, Private, Public). For tighter control, create a rule that blocks all inbound connections that are not explicitly allowed:
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
Common mistake: disabling the firewall to “speed up gaming.” Modern games work fine with the default firewall rules, and you can add specific exceptions instead of turning it off entirely.
Step 6: Enable File History or OneDrive Backup
Ransomware often encrypts files, leaving you with no way to recover. Windows’ built‑in File History creates versioned backups of your personal folders. Open Settings > Update & Security > Backup, click Add a drive, and select an external USB or network location. Turn on Automatically back up my files. If you prefer cloud, enable OneDrive sync for Documents, Pictures, and Desktop.
powershell -Command "Enable-FileHistory"
Common mistake: pointing File History to the same internal drive. That defeats the purpose because ransomware can encrypt both the source and the backup simultaneously.
Common Mistakes to Avoid
1. Disabling security features for convenience. Every toggle you turn off is a new attack surface.
2. Storing recovery keys on the encrypted drive. Keep them on a separate USB or in a password manager.
3. Skipping regular Windows updates. Attackers exploit known vulnerabilities faster than you can patch them.
4. Neglecting to whitelist legitimate applications. Over‑blocking can cripple productivity and lead you to disable CFA altogether.
5. Relying on a single backup method. Combine local File History with cloud sync for redundancy.
Tips and Tricks
• Use PowerShell scripts to automate the enabling of multiple defenses on fresh installations.
• Schedule a weekly “defender quick scan” via Task Scheduler: powershell -Command "Start-MpScan -ScanType QuickScan".
• Enable Network Protection (under Ransomware protection) to block malicious IPs before they reach your PC.
• Set a BIOS/UEFI password so thieves can’t bypass Windows security by resetting the OS.
• Periodically test your backup restore process—knowing it works is half the battle.
Frequently Asked Questions
Will turning on Controlled Folder Access slow my PC?
No. CFA runs in the background and only intervenes when an app tries to write to a protected folder. The performance impact is negligible on modern hardware.
Can BitLocker protect me from ransomware if I don’t use a password?
Yes, if your device has a TPM (Trusted Platform Module). TPM‑only mode encrypts the drive and unlocks it automatically at boot, keeping the key out of reach from malware that runs after Windows starts.
Is Microsoft Defender enough, or should I still buy third‑party antivirus?
For most home users, Defender combined with the other built‑in tools provides comprehensive protection. Third‑party suites can add layers, but they also introduce complexity and potential conflicts. Evaluate your risk profile before adding extra software.
Conclusion
Ransomware may sound scary, but Windows already ships with a full arsenal of defenses—if you activate and configure them correctly. By keeping the system updated, enabling Defender, turning on Controlled Folder Access, encrypting the drive with BitLocker, locking down the firewall, and maintaining regular backups, you create a multi‑layered shield that stops ransomware before it can do damage. Follow the steps above, avoid the common pitfalls, and you’ll enjoy peace of mind knowing your PC is as resilient as it can be using only the tools Microsoft gave you for free.
