Windows computer security basics

Most home computers in Australia run Microsoft Windows, and Windows comes with its own security features: updates, antivirus, a firewall, sign-in options, backup and a way to find a lost laptop. This guide explains how to secure a Windows PC with those built-in features, including on a computer with no extra antivirus installed: what each one does, how to check it’s on in Windows 11, and what Microsoft and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) say about it.

Microsoft changes menus between versions, so each section links to the Microsoft page with the latest steps.

Why it matters

A computer is often where banking, email, tax records and photos all live. Each setting covers a different risk:

• Updates close weaknesses that criminals and malware use to get in.
• Microsoft Defender Antivirus and the firewall watch for malware and block suspicious network traffic.
• A sign-in and screen lock keep the computer private if someone else picks it up.
• Two-step verification protects the Microsoft account behind the computer, which may also hold email, OneDrive files and purchases.
• A backup means files can be restored if the computer fails, is stolen or is hit by ransomware.
• Find My Device can help locate or lock a lost laptop.

The ACSC’s personal cyber security first steps guide starts with automatic updates, then multi-factor authentication, then backups and passphrases. Two of the settings here only help if they’re set up before something goes wrong: Find My Device, and a backup.

How to keep Windows updated

The ACSC describes automatic updates as “a ‘set and forget’ feature that updates your software as soon as it becomes available”, and says: “The easiest way to stay on top is by turning on or confirming automatic updates where possible.”

Windows downloads and installs updates through Windows Update. Microsoft explains that its Get the latest updates as soon as they’re available setting only affects non-security updates and new features: “Whether you set the toggle to Off or On, you’ll still get the regular security updates as usual.”

Based on Microsoft’s instructions (checked October 2026). Menus can change between versions; Microsoft’s Install Windows updates page has the latest steps.

1. Select Start, then Settings, then Windows Update. (In Windows 10: Settings > Update & Security > Windows Update.)
2. Select Check for updates.
3. If updates are found, select Download & install.
4. Restart the computer if Windows asks. Microsoft says: “If prompted to do so, restart your device to apply the updates.”
5. Optionally, turn on Get the latest updates as soon as they’re available on the same page, as described on Microsoft’s page about that setting.

When Windows stops getting updates

“End of support” means a product no longer receives updates or technical support. The ACSC says: “The risk of a cybersecurity incident is much higher when a product reaches end of support.”

Microsoft states that Windows 10 reached end of support on 14 October 2025. Microsoft says the computer keeps working, but it no longer gets software updates, security updates or fixes, or technical support. Microsoft’s Windows 10 end-of-support page describes its options: upgrading an eligible computer to Windows 11, buying a new Windows 11 computer, or using the consumer Extended Security Updates (ESU) program, which Microsoft says “can protect your Windows 10 device till October 12, 2027.”

The ACSC’s end-of-support page says: “The best way to stay protected is to upgrade to a new product.” Its examples of products at end of support include Windows 7 and 8.1. Where that isn’t an option, its tips include disconnecting the device from the internet and other networks where possible, not storing important data on it or logging in to accounts with it, and uninstalling software that’s no longer used. When an old computer is replaced, our guide to resetting a Windows PC before selling or recycling it covers wiping it first.

How to check Microsoft Defender Antivirus is on

Windows Security is the app that brings Windows’ built-in protection together. Microsoft says it “includes features such as Microsoft Defender Antivirus, Windows Firewall, and Smart App Control”, and that “Microsoft Defender Antivirus continuously scans your device for potential threats.” Its real-time protection checks files as they’re opened or downloaded.

On a computer with no other antivirus installed, Defender is the antivirus doing that job. Microsoft says: “If you install a compatible non-Microsoft antivirus program Microsoft Defender antivirus will automatically turn itself off.” So the thing to check is that one of them is running.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Windows Security page and virus and threat protection page have the latest steps.

1. Select Start, search for Windows Security and open it.
2. Select Virus & threat protection to see the current status.
3. Select Manage settings and check Real-time protection is on.
4. On the same screen, check Tamper protection. Microsoft says it “helps prevent malicious apps from changing important” security settings.
5. Back on Virus & threat protection, select Protection updates > Check for updates. Microsoft says these also download automatically through Windows Update.
6. To run a check, select Quick scan. Microsoft describes running one straight away if malware or a virus is suspected. Scan options has full, custom and offline scans; Microsoft notes the offline scan restarts the computer.

Microsoft warns that “While real-time protection is off, files you open or download won’t be scanned for threats.” It says real-time protection turns itself back on after a short while, and that scheduled scans keep running while it’s off.

The same area has Manage ransomware protection, where Microsoft describes Controlled folder access, which “prevents unknown apps from changing files in protected folders.” Our guide to how ransomware works and what limits the damage explains where this and backups fit.

How to check the Windows firewall is on

A firewall decides which network connections are allowed in and out. Microsoft says the Windows firewall “monitors incoming and outgoing network traffic”, which helps block suspicious activity.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Turn Windows Firewall on or off page has the latest steps.

1. Open Windows Security and select Firewall & network protection.
2. Windows Security shows which network the computer is connected to. Select that profile: Domain network, Private network or Public network.
3. Under Microsoft Defender Firewall, check the switch is set to On.

Microsoft warns: “Turning off Windows Firewall could make your device more vulnerable to unauthorized access.” If an app is being blocked, Microsoft describes allowing that app through the firewall rather than turning the firewall off. On a computer managed by a workplace, Microsoft says policy settings may stop these being changed. For setting a café or airport network to Public, see our guide to public Wi-Fi and fake hotspots.

How to set up Windows Hello sign-in

A sign-in stops other people using the computer. Windows Hello is Microsoft’s name for signing in with a PIN, face or fingerprint instead of typing a password each time. Microsoft says a Windows Hello PIN “is only associated with one device, and it’s backed up for recovery with your Microsoft account.” Face sign-in needs a compatible infrared camera, and fingerprint sign-in needs a fingerprint reader.

The ACSC’s first steps guide describes locking devices “with a passphrase, password, PIN or passcode”, and setting them “to automatically lock after a short time of inactivity.”

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Configure Windows Hello page has the latest steps.

1. Open Settings, then select Accounts > Sign-in options.
2. Under Ways to sign in, choose Facial recognition (Windows Hello), Fingerprint recognition (Windows Hello) or PIN (Windows Hello).
3. Select Set up.
4. Follow the on-screen instructions.

How to lock Windows automatically when you step away

Dynamic lock pairs the computer with a phone over Bluetooth. Microsoft says the computer then locks about a minute after the phone goes out of Bluetooth range.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Lock Windows automatically page has the latest steps.

1. Pair the phone with the computer over Bluetooth (Microsoft links a separate guide for this).
2. Open Settings, then Accounts > Sign-in options.
3. Select Dynamic lock.
4. Tick Allow Windows to automatically lock your device when you’re away.

Standard and administrator accounts

Windows accounts are either administrator or standard. The ACSC’s user account guidance explains that “An administrator account has complete control of a computer”, which makes it a target. It describes using a standard account for everyday tasks such as email and web browsing, giving each person their own standard account, keeping a separate administrator account for tasks like adding users, and using a strong, unique passphrase of at least four words. The ACSC notes that on Windows, the account type can be changed in Control Panel or Settings.

How to turn on two-step verification for a Microsoft account

Many Windows computers are signed in with a Microsoft account, which can also hold Outlook.com email, OneDrive files and purchases. The ACSC says multi-factor authentication “makes it harder for cybercriminals to gain initial access to your account.”

Microsoft calls this two-step verification. After it’s on, signing in needs the password plus a second method, such as a code sent to another email address or phone, or the Microsoft Authenticator app. Microsoft warns that if the second method is lost, the password alone won’t be enough and it can take 30 days to regain access. It says it “strongly recommend[s]” having three pieces of security info on the account. Some older apps and devices may need an app password once two-step verification is on.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s two-step verification page has the latest steps.

1. Sign in to the Microsoft account at account.microsoft.com/security and open the Security page.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification and select Turn on.
4. Follow the on-screen instructions. If the Authenticator app is used, setup may show a QR code to scan.

Our guides to how to secure your online accounts, how passkeys work and planning account recovery cover the wider picture.

How to back up with Windows Backup

The ACSC describes backing up as “a precautionary measure so that it can be recovered if it is ever lost, stolen or damaged.”

The Windows Backup app copies the Desktop, Documents, Pictures, Videos and Music folders to OneDrive, along with Windows settings and a list of installed apps. Microsoft says it needs a personal Microsoft account (“Work or school Microsoft accounts won’t work”), and that a free account includes 5 GB of OneDrive storage, with more available to buy. When setting up a new computer with the same Microsoft account, Microsoft says Windows offers to restore the backup.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Windows Backup page has the latest steps.

1. Check the computer is signed in with a personal Microsoft account in Settings > Accounts.
2. Select Start, type backup, and open Windows Backup.
3. Expand Folders and turn on the folders to back up.
4. Expand the settings and apps categories and turn on what to include.
5. Select Back up.
6. To check progress later, open Windows Backup again, or go to Settings > Accounts > Windows backup.

A cloud copy is one copy. Our guide to the 3-2-1 approach to backups explains keeping more than one, including an offline copy.

How to turn on Find My Device

Find My Device shows a lost Windows laptop or tablet on a map and can lock it remotely. Microsoft lists the requirements: Windows 10 or 11, a personal Microsoft account, an account type of “Administrator”, location turned on, and the feature itself turned on before it’s needed. Microsoft notes that anyone using the device sees a notification when someone tries to locate it.

Based on Microsoft’s instructions (checked October 2026). Microsoft’s Find or lock a lost Windows device page has the latest steps.

1. On the computer, open the Find my device settings (Microsoft’s page has a link that opens them directly) and turn on Find my device.
2. Check that location is turned on for the device.
3. If the device goes missing, go to account.microsoft.com/devices on another device and sign in.
4. Select the Find My Device tab, choose the device and select Find to see it on a map.
5. To lock it, select Lock, then Next. Microsoft describes resetting the account password after the device locks.

For a stolen device, Microsoft describes reporting it to local police and the insurance company, and notes the serial number is under Info and support at account.microsoft.com/devices.

How to review app permissions and privacy settings

App permissions decide which apps can use things like location, the camera and the microphone. The ACSC’s first steps guide says to “Check the privacy permissions carefully when installing new apps on your device, particularly for free apps.”

Based on Microsoft’s instructions (checked October 2026). Microsoft’s App permissions page has the latest steps.

1. Select Start, then Settings, then Privacy & security.
2. Select a permission, such as Location, Camera or Microphone.
3. Review which apps have access, and turn access off for any app that doesn’t need it.

The same Privacy & security page lists the other capabilities apps can ask for, from contacts to files. Working through it once, and again after installing new software, shows which apps can reach what.

Microsoft notes a limit. Traditional desktop apps that have permission to “Access all your files, peripheral devices, apps, programs, and registry” aren’t listed on the Privacy page, and “You can’t use the Privacy settings to control what capabilities these apps can use.” Microsoft says an app’s permissions can be seen on its Microsoft Store page before installing.

Things to watch for

• An unsupported version of Windows. Microsoft says Windows 10 no longer gets security updates unless the computer is enrolled in ESU. The ACSC describes the risk as much higher at end of support.
• Real-time protection or the firewall turned off. Microsoft says files aren’t scanned while real-time protection is off, and that turning off the firewall could make a device more vulnerable.
• Pop-ups or calls saying the computer is infected. Our guide to fake tech support and remote access scams explains how scammers use these.
• Losing the second sign-in method. Microsoft warns it can take 30 days to regain access and recommends three pieces of security info.
• Settings that have to be on beforehand. Find My Device and backups can’t be switched on after the computer is gone.
• Desktop apps from unfamiliar sources. Microsoft says Privacy settings can’t control most of what these apps can do.
• Work or school accounts. Windows Backup and Find My Device work with personal Microsoft accounts, and a workplace computer follows its organisation’s settings. Our guide to working from home securely covers employer devices.

Common questions

How do I secure my Windows PC?

Windows has a built-in feature for each of the main risks: Windows Update, Microsoft Defender Antivirus, the firewall, Windows Hello sign-in, two-step verification on the Microsoft account, Windows Backup and Find My Device. The ACSC’s first steps guide starts with automatic updates, then multi-factor authentication, then backups and passphrases. Find My Device and a backup only help if they’re set up before something goes wrong. The steps start at how to keep Windows updated.

Is Windows Defender enough?

This guide can’t say whether it’s enough for a particular computer, and doesn’t recommend any product. Microsoft says Windows Security is built into Windows and includes Microsoft Defender Antivirus and a firewall, and that Defender “continuously scans your device for potential threats.” The ACSC’s personal cyber security first steps guide focuses on updates, multi-factor authentication, backups, passphrases and screen locks, and doesn’t discuss antivirus software. See how to check Microsoft Defender Antivirus is on.

Do I need antivirus on Windows 11?

Windows 11 already includes one: Microsoft Defender Antivirus, part of the Windows Security app. On a computer with no other antivirus installed, Defender is the antivirus doing that job. Microsoft says it turns itself off automatically if a compatible non-Microsoft antivirus is installed, so the thing to check is that one of them is running. This guide doesn’t recommend any product; our antivirus software guide explains what to compare when considering a separate one.

Is Windows 10 still safe to use?

It keeps working, but Microsoft says it no longer gets security updates after 14 October 2025, apart from computers enrolled in the consumer Extended Security Updates (ESU) program, which Microsoft says covers them “till October 12, 2027.” The ACSC says “The risk of a cybersecurity incident is much higher when a product reaches end of support”, and “The best way to stay protected is to upgrade to a new product.” See when Windows stops getting updates.

What do I do if a pop-up says my computer is infected?

Scammers use pop-ups and calls like this, as our guide to fake tech support and remote access scams explains. To check the computer itself, Microsoft describes opening Windows Security > Virus & threat protection and selecting Quick scan, and running one straight away if malware or a virus is suspected. The ACSC’s 24/7 hotline is 1300 CYBER1 (1300 292 371). See how to check Microsoft Defender Antivirus is on.

How do I find a lost Windows laptop?

Find My Device can show it on a map and lock it remotely, if it was turned on before the laptop went missing. Microsoft lists the requirements as Windows 10 or 11, a personal Microsoft account, an Administrator account type and location turned on. Microsoft describes signing in at account.microsoft.com/devices on another device and opening the Find My Device tab. For a stolen device, it describes reporting it to local police and the insurance company. See how to turn on Find My Device.

Where to get official help

• Microsoft Support (support.microsoft.com) has the current steps for every Windows setting in this guide.
• ASD’s ACSC publishes guidance on updates and end of support and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371), listed on its where to get help page. Cybercrime can be reported through ReportCyber.
• The My security checklist lists these topics for the devices you use, so you can tick off what you’ve checked.

Related guides

• How to secure your online accounts
• Passkeys explained
• An account recovery plan
• Backups for personal devices: the 3-2-1 approach
• Selling, giving away or recycling a device
• Mac security basics
• Chromebook security basics