• Posted by: Eng. Donya Bino
• December 09, 2025

How to Harden Windows Machines in 10 Practical, Simple Steps

Securing a Windows machine isn’t glamorous. No one high-fives you for enabling BitLocker. But these small tweaks are usually the reason a ransomware operator gives up and moves on to an easier target.

If you want a quick, practical checklist you can run through in under an hour, this is it. Ten simple steps that make attackers sigh and look elsewhere.

1. Turn On Automatic Updates
Yes, updates can be annoying. But attackers love unpatched machines even more.
Just let Windows update itself and save yourself a lot of trouble.

2. Enable BitLocker
If someone steals your laptop and the drive isn’t encrypted, you basically handed them your entire life.
BitLocker fixes that with one switch.

3. Use a Standard User Account
Don’t run your daily work with admin privileges.
It’s like leaving your front door open because you “might need to bring in groceries.”

4. Remove Software You Don’t Use
Old apps become old vulnerabilities.
If you don’t remember installing it, or haven’t opened it in years, it’s probably not helping you.

5. Turn On Controlled Folder Access
This feature blocks suspicious apps from encrypting your files.
It won’t stop every threat, but it stops the sloppy ones, which is most of them.

6. Enable Windows Defender SmartScreen
It catches a surprising amount of shady downloads and phishing sites.

7. Disable Macros Unless You Truly Need Them
If you don't work with complex Excel automation, turn macros off.
They’re still one of the easiest ways for malware to sneak in.

8. Harden RDP (or Just Turn It Off)
If you don’t need Remote Desktop, disable it.
If you do need it, at least:
1. Use a non-default port
2. Add MFA
3. Restrict to known IPs
Attackers scan for exposed RDP all day long, don’t make it easy.

9. Enable Firewall and Block Unnecessary Inbound Traffic
Windows Firewall is actually solid these days. Keep it on.
Only allow the inbound rules you understand. (If you don’t know why a rule is there, it probably shouldn’t be.)

10. Use Credential Guard and LSASS Protection
These stop one of the most common attack paths: stealing credentials from memory.
It takes a minute to enable, and it removes a whole category of attacks.

Hardening doesn’t have to be complicated. Most attackers don’t rely on “elite hacker magic.” They rely on people forgetting basic settings.
You knock out these ten steps, and you’ve already beaten half the threats out there.