Ransomware Protection on Windows 11: A Practical Guide
A few years back, a dentist called me at 7 a.m. on a Monday. Every patient file on her front-desk PC had been renamed to end in ".locked", and a note on the desktop wanted $8,000 in Bitcoin. The PC ran Windows 11. Windows Defender was on. As far as she knew, she'd done everything right.
She hadn't turned on the one Windows feature built to stop exactly that attack. And her only backup was a USB drive that stayed plugged in day and night, so the ransomware encrypted that too.
I've spent the last 10 years cleaning up after attacks like hers, mostly for small offices, freelancers and families. What still gets to me is how many of them were preventable with settings already sitting inside Windows. People just don't know where to find them.
This guide is the setup I use on my own machines and my clients' machines. By the end you'll have proper ransomware protection on Windows 11, a backup nobody can hold hostage, and a plan for the bad day if it ever comes. I've kept the jargon to a minimum and left out anything that doesn't make a real difference.
Published: 2026-10-19 · Updated: 2026-10-19 · Published by IZenica Technologies LLC
How ransomware actually gets onto a Windows 11 PC
It helps to know how these attacks start before you touch any settings. Almost none of the cases I've worked involved some genius breaking through Windows itself. The attacker walks in through the front door, and somebody holds it open.
The same entry points come up again and again:
Most of these need you to run something or let someone in. That's good news, because it means your habits and a handful of settings can close most of the gaps.
- Email attachments and links. A fake invoice, a "missed delivery" notice, a shared document that asks you to enable macros. This is still the most common route by a long way.
- Cracked software and fake downloads. Free copies of paid apps, game mods, "driver updaters" from random sites. One client's teenage son grabbed a free video editor and took down the entire home network.
- Remote Desktop left open to the internet. Small businesses that expose Remote Desktop (RDP) with a weak password usually get found by automated scanners within days.
- Unpatched software. An old browser, an outdated PDF reader, the VPN client nobody has touched since 2023.
- Stolen passwords, leaked from some other site and reused on your Microsoft account or work email.
Turn on Controlled Folder Access (most people skip this)
If you only do one thing from this article, do this. Controlled Folder Access is Microsoft's built-in ransomware protection for Windows 11, and it ships switched off. I still find it disabled on roughly nine out of ten machines I look at.
It locks your important folders (Documents, Pictures, Desktop and a few others) so only trusted apps can change the files inside. When an unknown program tries to rewrite those files, Windows blocks it and pops up a notification. Ransomware has to rewrite files to do its damage, so this stops it cold.
To turn it on:
Expect a few legitimate apps to get blocked in the first week. Older accounting software and some photo editors are repeat offenders. When it happens, don't switch the feature off. Go to Allow an app through Controlled folder access and add the app you trust. It's five minutes of fiddling, and the alternative is losing a decade of family photos.
- Open Windows Security from the Start menu.
- Go to Virus & threat protection.
- Scroll down to Ransomware protection and click Manage ransomware protection.
- Switch Controlled folder access to On.
- Click Protected folders and add anywhere else you keep work, like a D: drive or a client projects folder.
Use Smart App Control, SmartScreen and Core isolation
Controlled Folder Access protects your files once something bad is already running. These three try to keep it from running in the first place.
Smart App Control checks every app against Microsoft's cloud reputation data before it opens, and blocks unsigned or unknown programs. For years it had a maddening catch: switch it off once and the only way back was a full Windows reset. The April 2026 cumulative update (KB5083769, for versions 24H2 and 25H2) fixed that, and you can now toggle it whenever you like under Windows Security > App & browser control > Smart App Control settings. If you mostly use mainstream apps, turn it on. Developers and people who run a lot of niche tools may find it blocks too much, and that's a fair reason to leave it off.
SmartScreen lives in the same App & browser control area and warns you before you open downloads or websites with a bad reputation. Check that Reputation-based protection is on, including Potentially unwanted app blocking. I once watched SmartScreen stop a fake Zoom installer on a client's laptop before it could do anything.
Core isolation and Memory integrity are under Windows Security > Device security. Memory integrity makes it much harder for malware to tamper with the deepest layers of Windows. Most PCs bought in the last few years have it on already, but check anyway. If an old driver is keeping it off, update or remove the driver and switch it on.
My own rule: when Windows warns me about a file, the answer is no unless I have a very good reason. Clicking "Run anyway" is how about half the infections I've cleaned up began.
Build backups that ransomware can't touch
The dentist did have a backup. It just wasn't safe. Modern ransomware hunts for connected drives and network shares on purpose and encrypts them along with your C: drive.
A backup only counts if the attacker can't reach it. I go by the old 3-2-1 rule: three copies of your data, on two different kinds of storage, with one copy kept offline or offsite.
On a typical Windows 11 setup, that looks like this:
Test your restores, too. A small law office once told me their backups ran every night. They did run. The job had also been failing silently for 14 months. Once a month, pick a random file and restore it. Two minutes tells you whether the safety net is really there.
- Copy 1 is your working files on the PC.
- Copy 2 is a cloud service with version history, such as OneDrive. With a Microsoft 365 subscription, OneDrive's Files Restore can roll your whole folder back to any point in the last 30 days. It has bailed out more than one of my clients.
- Copy 3 is an external drive. Plug it in once a week, run File History or your backup tool, then unplug it. The unplugging is the part that matters.
Lock down updates, accounts and remote access
I'll admit this section is dull. It's also where a lot of real attacks succeed.
Keep everything updated, not only Windows. Windows Update covers the operating system, but attackers love stale third-party apps. Once a month, open the Microsoft Store and click Get updates, then check your browser, PDF reader and any VPN or remote access tools. If the maker hasn't updated an app in years, replace it.
Stop doing daily work in an admin account. Most home users run as administrator all day long. I set up a separate standard account for everyday use and save the admin account for installing things. Ransomware running under a standard account has a much harder time switching off protections or touching system files. I've seen this single change stop attacks in the logs.
Turn on two-factor authentication for your Microsoft account, your email and anything that syncs files. Then a stolen password on its own won't get anyone in.
Close Remote Desktop to the internet. If you don't use it, confirm it's off under Settings > System > Remote Desktop. If you need remote access, put it behind a VPN rather than exposing it directly. Small offices that skip this end up in my inbox far too often.
Is Microsoft Defender enough, or do you need more?
This is the question I get asked most, so here's my straight answer. Microsoft Defender is a solid antivirus these days. Paired with the settings above, it gives a careful home user reasonable ransomware protection on Windows 11 for free.
"Reasonable" has limits, though. These are the gaps I've run into with Defender-only setups:
Where I land: if you're one person with good backups who rarely downloads anything odd, Defender plus the steps in this guide is fine. If you run a small business, handle client data, share the PC with kids, or just can't afford to lose files, a dedicated suite is worth paying for. Bitdefender Total Security is the one I'd look at, for its multi-layer ransomware protection and its Ransomware Remediation feature, which restores files an attack has encrypted. Whatever you choose, don't run two real-time antivirus products at the same time. They fight each other.
- Brand-new strains. Defender leans heavily on its known-threat data and cloud lookups. It does watch behavior, but some dedicated tools go further, looking specifically for ransomware patterns (like one process suddenly encrypting hundreds of files) and killing it mid-attack.
- Getting files back. Controlled Folder Access blocks, but it can't undo anything. Some security suites keep temporary copies of files as they change and restore them if they detect an attack. That can be the difference between losing 40 files and losing none.
- Web and phishing filtering in other browsers. SmartScreen works best in Microsoft Edge. If your family uses Chrome or Firefox, a suite with its own web filtering adds a layer.
- Mixed devices. Most households have Windows PCs next to Macs, Android phones and iPhones, and one subscription covering all of them is easier to manage.
What to do if you get hit anyway
No setup is perfect. If you ever see a ransom note, or your files suddenly have strange extensions, the first ten minutes matter most. This is the order I walk clients through on the phone:
- Disconnect from the network. Pull the Ethernet cable and turn off Wi-Fi so the infection can't spread to other devices or your cloud sync.
- Leave the PC on for now. Keep it running but disconnected, because some recovery tools and investigators can pull useful data from a live machine.
- Photograph the ransom note and the new file extensions with your phone. You'll need these for reporting and for working out which strain you're dealing with.
- Look for a free decryptor. The No More Ransom project, backed by Europol and several security companies, hosts free decryption tools for many older strains.
- Report it. In the U.S., file a report with the FBI's Internet Crime Complaint Center (IC3). Businesses may also have legal reporting duties, depending on what data was involved.
- Wipe and restore. Reinstall Windows cleanly, then bring your files back from the offline backup. Change your passwords from a different device you know is clean.
- Should you pay? I always tell clients not to. Paying funds the next attack, and I've seen people pay and get a decryptor that only worked on half their files. With a tested offline backup, this whole list turns into an annoying afternoon.
Conclusion: spend 30 minutes today
Ten years of these phone calls have taught me that fancy gear has little to do with who recovers quickly. The people who bounce back are the ones who spent half an hour on setup before anything went wrong.
So, for today: turn on Controlled Folder Access, check Smart App Control and SmartScreen, make sure Memory integrity is on, set up a backup drive you actually unplug, and switch your daily account to a standard user. That alone puts you ahead of most Windows users I meet.
If you'd like a layer that catches new strains and can roll back encrypted files on its own, have a look at Bitdefender's security plans. They add to the ransomware protection Windows 11 already gives you, and in my experience they don't slow the PC down. Explore Bitdefender protection plans and pick the one that fits your household or business.
And if this guide helped, send it to the one friend or relative who still keeps every file on their desktop. You know exactly who I mean.
Frequently asked questions
- Does Windows 11 have built-in ransomware protection?
- Yes. Windows 11 includes Controlled Folder Access, which stops untrusted apps from changing files in protected folders. It's off by default, so you have to turn it on under Windows Security > Virus & threat protection > Manage ransomware protection. Smart App Control, SmartScreen and OneDrive's file recovery add more protection on top.
- Can ransomware encrypt my OneDrive files?
- Yes. OneDrive syncs whatever happens on your PC, encrypted files included. The upside is that OneDrive keeps version history, and Microsoft 365 subscribers can use Files Restore to roll the whole folder back to a point before the attack, up to 30 days back. That's also why a separate offline backup is still worth having.
- Is it safe to turn off Controlled Folder Access if it blocks my apps?
- I wouldn't. Rather than switching it off, add the blocked app to the list under "Allow an app through Controlled folder access." Only allow apps you installed yourself from a source you trust. Turning the whole feature off throws away one of the best defenses Windows has against ransomware.
Recommended product
For supported smartphones, review the product details and current platform coverage before choosing protection. Security software can help with some device threats, but it cannot verify who is speaking on a phone call.
Explore Bitdefender Total Security
View all Bitdefender guides · Explore Bitdefender Total Security · Is Microsoft Defender enough? · How to remove malware safely · Avoid malicious email links and downloads