Ransomware has become one of the most damaging threats to modern enterprises and home users alike. While backups and user education are essential, a truly resilient Windows 10 environment relies on layered defenses that make it difficult for ransomware to gain a foothold. In this guide we’ll walk through advanced, practical steps you can apply today to harden Windows 10 against ransomware. The instructions are written for IT professionals who are comfortable using PowerShell, Group Policy, and the Windows Registry, but each step includes clear screenshots and explanations for anyone willing to dig a little deeper.
What You’ll Need
- Windows 10 Pro, Enterprise, or Education (Home edition lacks many hardening controls)
- Administrative rights on the target machine or domain
- PowerShell 5.1 or later
- Access to Group Policy Management Console (GPMC) if you manage multiple PCs
- External backup solution (offline or cloud) – this guide does not replace backups
Step 1: Enable BitLocker Full‑Disk Encryption
Encrypting the entire drive prevents ransomware from encrypting data that it cannot read. Open an elevated PowerShell window and run:
Enable‑BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector
After the command finishes, verify the status:
Get‑BitLockerVolume -MountPoint "C:"
Make sure the ProtectionStatus reads On. Store the recovery key in a secure, offline location – for example, a hardware token or a dedicated password manager.
Step 2: Configure Windows Defender Exploit Guard – Controlled Folder Access
Controlled Folder Access (CFA) blocks unauthorized programs from writing to protected directories. To enable it via PowerShell:
Set‑MpPreference -EnableControlledFolderAccess Enabled
Next, add the folders you want to protect (typically %UserProfile%Documents, %UserProfile%Desktop, %UserProfile%Pictures).
$folders = @(
"$env:USERPROFILEDocuments",
"$env:USERPROFILEDesktop",
"$env:USERPROFILEPictures"
)
foreach ($folder in $folders) {
Add-MpPreference -ControlledFolderAccessProtectedFolders $folder
} Finally, whitelist trusted applications that need write access (e.g., Microsoft Office). Use the following pattern:
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:Program FilesMicrosoft OfficerootOffice16WINWORD.EXE"
Repeat for Excel, PowerPoint, and any other productivity tools.
Step 3: Deploy AppLocker or Software Restriction Policies
AppLocker allows you to create whitelists for executable files, scripts, and DLLs. In a domain environment, open the Group Policy Management Console, create a new GPO, and navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Application Control Policies → AppLocker. Create three rule collections:
- Executable Rules: Allow only signed binaries from
Program Files,Windows, and a curated list of third‑party tools. - Windows Installer Rules: Block MSI files from Internet zones; allow only those from trusted internal shares.
- Script Rules: Disable PowerShell scripts that are not signed. Use the following PowerShell command to enforce the policy on a local machine:
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope LocalMachine
After publishing the GPO, run gpupdate /force on client PCs and verify with Get-AppLockerPolicy -Effective -XML.
Step 4: Harden Remote Desktop and Network Shares
Ransomware often spreads laterally via RDP or SMB. Disable RDP if it’s not required:
Set-ItemProperty -Path "HKLM:SystemCurrentControlSetControlTerminal Server" -Name fDenyTSConnections -Value 1
If RDP is needed, enforce Network Level Authentication (NLA) and limit users through the Remote Desktop Users group. For SMB shares, enable the “SMB Encryption” feature:
Set-SmbServerConfiguration -EncryptData 1 -Force
Additionally, restrict share permissions to Read for most users and Full Control only for administrators.
Step 5: Configure Advanced Auditing and Real‑Time Monitoring
Enable detailed audit policies to catch suspicious activity early. In the Local Security Policy (secpol.msc) go to Advanced Audit Policy Configuration → Object Access → File System and enable “Audit File Creation” and “Audit File Deletion” for both success and failure. Export the settings via PowerShell for consistency:
AuditPol /set /subcategory:"File System" /success:enable /failure:enable
Pair this with Windows Event Forwarding (WEF) to a central SIEM. On the client, run:
wecutil qc
Then configure a subscription on the collector server to pull Microsoft-Windows-Sysmon/Operational events, which provide granular process creation logs useful for spotting ransomware payloads.
Step 6: Apply the Latest Firmware and Software Updates
Out‑of‑date drivers and firmware are a common ransomware entry point. Use Windows Update for Business (WUfB) to enforce a rapid patch cadence:
Set-ItemProperty -Path "HKLM:SoftwarePoliciesMicrosoftWindowsWindowsUpdate" -Name AUOptions -Value 4
Additionally, schedule a weekly wuauclt /detectnow run and verify that the Windows Update Medic Service is enabled. For BIOS/UEFI, automate vendor‑specific tools (e.g., Dell Command | Update) via SCCM or Intune.
Common Mistakes to Avoid
Even seasoned admins slip into habits that undermine hardening. Below are the most frequent pitfalls and how to sidestep them:
- Turning off Controlled Folder Access entirely because a legitimate app is blocked. Instead, add the app to the whitelist – this preserves protection while maintaining productivity.
- Storing BitLocker recovery keys on the same encrypted drive. Always keep keys offline or in a dedicated password manager.
- Using “Allow all” AppLocker rules for convenience. A permissive rule defeats the purpose of a whitelist; start with a “Deny all” baseline and add exceptions deliberately.
- Neglecting regular backup verification. A backup that cannot be restored is as good as no backup. Test restoration quarterly.
- Disabling Windows Defender real‑time protection to install third‑party AV. If you must replace Defender, ensure the new solution offers comparable ransomware‑specific features (e.g., behavior monitoring, controlled folder access).
Tips and Tricks
Here are a few extra knobs you can turn to tighten security without major disruption:
- Enable PowerShell Constrained Language Mode for non‑admin accounts:
Set-ItemProperty -Path "HKLM:SOFTWAREMicrosoftPowerShell1ShellIdsMicrosoft.PowerShell" -Name LanguageMode -Value ConstrainedLanguage. - Deploy Windows Defender Application Guard (WDAG) for Edge to isolate web browsing sessions from the OS.
- Use the “Windows Sandbox” feature for testing unknown installers before they touch the production environment.
- Set the “NoDriveTypeAutoRun” registry key to block autorun on removable media:
Set-ItemProperty -Path "HKLM:SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer" -Name NoDriveTypeAutoRun -Value 0xFF.
Frequently Asked Questions
Will BitLocker affect system performance?
Modern CPUs include hardware‑accelerated AES‑NI instructions, so the performance impact of XTS‑AES‑256 encryption is negligible for most workloads. The biggest slowdown you may notice is during the initial encryption phase, which can be scheduled for off‑peak hours.
Can Controlled Folder Access block legitimate backup software?
Yes, if the backup agent writes to a protected folder without being whitelisted. Add the backup executable to the CFA allowed list using Add-MpPreference -ControlledFolderAccessAllowedApplications or temporarily disable CFA during backup windows.
Is AppLocker available on Windows 10 Home?
No. Home edition only supports Software Restriction Policies, which are less flexible. For full AppLocker functionality you need Pro, Enterprise, or Education editions.
Conclusion
Ransomware is a moving target, but by implementing a layered defense—full‑disk encryption, controlled folder access, strict application whitelisting, hardened remote access, continuous monitoring, and diligent patch management—you dramatically reduce the attack surface of any Windows 10 machine. Remember that no single control is foolproof; the strength lies in the combination. Pair these technical measures with a disciplined backup strategy and regular security awareness training, and you’ll give ransomware attackers very little room to operate. Stay vigilant, keep your policies up‑to‑date, and your Windows 10 environment will remain a robust fortress against ransomware threats.
