Windows Security Basics: Accounts, Updates and Protection

In short

These Windows security basics cover the handful of habits that protect most home computers: keeping Windows updated, using the built-in Windows Security app, protecting your sign-in, using standard accounts for everyday use, downloading software carefully, recognizing scams and keeping backups. You don’t need expensive extra software. Work through the checklist once, then keep the habits going.

Before you start

Windows 11 and Windows 10 both include Windows Security, with Microsoft Defender Antivirus and a firewall built in and switched on by default. If you installed another antivirus product, Windows Security shows it instead and Defender steps aside; that’s normal.

The biggest risks for most people aren’t sophisticated hacking. They are missed updates, reused passwords, fake websites that steal sign-in details, and scammers who phone or show pop-ups pretending to be from Microsoft or your bank. This tutorial addresses each.

Key terms

• Windows Security: the built-in app that shows the status of antivirus protection, firewall, account protection and device security.
• Firewall: a filter that blocks unwanted network connections to your computer. Leave it on.
• Two-step verification: a second check, such as a code on your phone, when signing in to an account.
• Phishing: fake emails, texts or websites designed to trick you into giving passwords or payment details.
• Standard account: a Windows account that can use apps but must ask an administrator to install software or change system settings.

Lesson 1: check your protection

1. Select Start, type Windows Security and open the app.
2. On the Home page, look for green ticks. A yellow or red symbol means something needs attention; select it and follow the recommended action.
3. Open Virus & threat protection. Under Virus & threat protection settings, check that Real-time protection is on.
4. Open Firewall & network protection and check that the firewall is on for each network type.
5. Open App & browser control and keep the Reputation-based protection options on. They warn you before you open unsafe downloads and websites.
6. Make sure Windows Update is installing updates; see our Windows Update tutorial.

Checkpoint: the Windows Security home page shows no warnings.

Lesson 2: protect your sign-in and accounts

1. Open Settings > Accounts > Sign-in options and set up a PIN, or face or fingerprint sign-in (Windows Hello) if your computer supports it.
2. Make sure your computer locks when you step away: press Windows logo key + L to lock it instantly, and in Sign-in options choose to require sign-in when the computer wakes up.
3. If several people share the computer, give each one their own account in Settings > Accounts > Other users, and make them Standard users unless they need to install software. Keep one administrator account for yourself.
4. Turn on two-step verification for your Microsoft account and your email account. Your email is the key to resetting other passwords, so protect it first. Google’s help page in Official documentation shows how for a Google Account; Microsoft and other email providers have similar options in their account security settings.
5. Use a different, long password for each important account. A password manager, including the ones built into web browsers, can remember them for you.

Lesson 3: everyday safe habits

1. Download software only from official places: the Microsoft Store or the publisher’s own website. Our tutorial on installing software safely explains how to spot the real site.
2. Read permission prompts. When Windows asks “Do you want to allow this app to make changes to your device?”, check the publisher name. If you didn’t start an installation, select No.
3. Spot tech-support scams. Microsoft doesn’t phone people out of the blue about viruses, and real security warnings don’t show phone numbers. If a pop-up locks your browser and urges you to call, close the browser (use Ctrl + Shift + Esc and End task if needed) and never give anyone remote access to your computer.
4. Check links before clicking. Hover over a link to see where it really goes, and type important addresses, such as your bank’s, yourself.
5. Turn on Find my device in Settings > Privacy & security > Find my device, so you can locate a lost laptop.
6. Check device encryption. On supported computers, Settings > Privacy & security > Device encryption protects your files if the laptop is stolen. If it’s on, make sure you know how to get the recovery key, which is usually saved to your Microsoft account.
7. Keep backups, so that no single problem can take your files; see backing up your files.

Check that it worked

Lock your computer with Windows logo key + L and sign in again with your PIN. Open Windows Security and confirm there are no warnings. Sign in to your email from a web browser and check that it asks for your second verification step.

If something goes wrong

• Windows Security shows a threat: follow its recommended action (usually Quarantine or Remove), then run a full scan and change passwords from a safe device.
• You gave a caller remote access: disconnect the computer from the internet, uninstall any remote-access program they installed, run a full scan, change passwords from another device and contact your bank if you shared payment details.
• Real-time protection keeps turning off: another antivirus program may be installed; check Settings > Apps > Installed apps. If you didn’t install one, run a full scan.
• You forgot your PIN: on the sign-in screen, select I forgot my PIN and verify with your Microsoft account.
• Your email was used to send spam: change its password immediately and turn on two-step verification.

FAQ

Do I need to buy antivirus software for Windows?

Windows includes Microsoft Defender Antivirus in the Windows Security app, which is switched on by default. Many home users find it enough when they also keep Windows updated and download carefully.

Will Microsoft ever call me about a virus?

No. Unexpected calls, texts or pop-ups claiming to be from Microsoft and asking you to call or allow remote access are scams.

Should I use a Microsoft account or a local account?

A Microsoft account makes it easier to recover your password, find a lost device and get your device encryption recovery key. Microsoft’s help pages explain both account types.

Is it safe to save passwords in my browser?

Browser password managers are a reasonable choice for most people, especially combined with a strong computer sign-in and two-step verification on your email.