Setting Up Ransomware Protection in Windows 11

A ransomware attack can turn years of work into inaccessible files in minutes. One malicious attachment, compromised download, or exploited application may be enough to encrypt important documents and disrupt your work. For individuals and IT teams, preventing that damage starts with understanding the security tools already available in Windows 11.

Microsoft includes several built-in security features that help defend against ransomware, including Microsoft Defender Antivirus, cloud-delivered protection, and Controlled Folder Access. When configured correctly and combined with reliable backups, these tools can reduce the risk of unauthorized file changes and make recovery easier if an attack occurs.

This guide explains how to enable ransomware protection in Windows 11, configure the most important settings, handle application compatibility issues, and build a practical defense strategy without installing unnecessary security software.

Why Ransomware Protection Matters in Windows 11

Ransomware is malware designed to deny access to files or systems, often by encrypting data and demanding payment for a decryption key. Some attackers also steal sensitive information and threaten to publish it, creating additional pressure on victims.

For a business, the consequences extend beyond lost documents. An infection can interrupt operations, expose customer information, affect shared resources, and create expensive recovery work.

Windows 11 includes security controls that address different parts of this threat:

Microsoft Defender Antivirus: Detects and blocks known malware and suspicious activity.
Cloud-delivered protection: Helps Defender respond to emerging threats using Microsoft’s cloud-based intelligence.
Controlled Folder Access: Helps prevent untrusted applications from modifying protected folders.
Windows and security intelligence updates: Improve protection against newly discovered vulnerabilities and threats.
Backup and recovery tools: Help restore files if ransomware damages or encrypts data.

No single feature guarantees complete protection. The goal is to combine preventive controls, timely updates, and recoverable backups.

Step 1: Open Windows Security

Start by checking that Windows Security is available and that Microsoft Defender Antivirus is active.

Open the Start menu.
Search for Windows Security.
Open the application.
Select Virus & threat protection.
Review the current protection status.

If you use Microsoft Defender Antivirus, check whether real-time protection is enabled. It monitors files and applications as you access or run them.

If another antivirus product is installed, some Defender settings may be managed differently or unavailable. Check the active security provider before changing configurations.

Practical tip: If you manage multiple business computers, document the current security configuration before rolling out changes. This makes troubleshooting and policy enforcement easier.

Step 2: Enable Microsoft Defender Antivirus Protection

Microsoft Defender Antivirus provides the foundation for built-in ransomware defenses.

Navigate to:

Windows Security → Virus & threat protection → Manage settings

Review the following options:

Real-time protection: Helps detect and block malware as files are opened, downloaded, or executed.
Cloud-delivered protection: Uses cloud-based security intelligence to help identify emerging threats.
Automatic sample submission: Allows suspicious samples to be sent to Microsoft for analysis, subject to the applicable settings and privacy considerations.
Tamper Protection: Helps prevent unauthorized changes to important security settings.

Enable the available protections appropriate for your environment. Some options may be controlled by organizational policies or unavailable when a different antivirus product is active.

Also, keep Microsoft Defender’s security intelligence up to date. Open Windows Update and install available security updates. In Windows Security, check for protection updates when necessary.

These settings help Defender identify threats, but they do not replace cautious handling of email attachments, downloaded files, or unexpected links.

Step 3: Turn On Controlled Folder Access

Controlled Folder Access is one of the most important Windows 11 features to understand when configuring ransomware protection. It helps protect files by preventing untrusted or unauthorized applications from making changes to protected folders.

For example, if ransomware attempts to encrypt documents in a protected folder, Controlled Folder Access may block the application before it can modify those files.

How to enable Controlled Folder Access

Follow these steps:

Open Windows Security.
Select Virus & threat protection.
Scroll to Ransomware protection.
Select Manage ransomware protection.
Find Controlled folder access.
Turn the setting On.

Once enabled, Windows helps protect selected folders against unauthorized modifications.

Which folders should you protect?

Windows protects certain folders by default. Depending on your environment, you may also want to protect additional locations containing important data.

Consider these examples:

Documents and spreadsheets used for daily work.
Desktop files containing active projects.
Pictures, personal records, and financial documents.
Local folders containing source code, configuration files, or business data.

To add a folder, open the Controlled Folder Access settings and select Protected folders, then use the option to add another protected folder.

Keep the scope practical. Protecting folders that contain critical data is useful, but you should also test applications that need to write to those locations.

Allow trusted applications when necessary

Controlled Folder Access can block legitimate applications that need to modify protected files. For example, a business application, backup utility, or development tool might need permission to write to a protected directory.

If a trusted application is blocked:

Open the ransomware protection settings.
Select Allow an app through Controlled folder access.
Review the available blocked-app information.
Add the application only if you have verified that it is legitimate and necessary.

Avoid allowing applications simply because they display an error. Verify the executable’s origin, digital signature where applicable, and business purpose first.

Important: Controlled Folder Access is not a substitute for antivirus scanning. It is an additional defensive layer focused on unauthorized changes to protected files.

Step 4: Configure Windows Security for Ongoing Protection

Enabling ransomware protection is only part of the process. Your Windows 11 device also needs regular maintenance to remain resilient against evolving threats.

Install Windows updates

Go to Settings → Windows Update → Check for updates.

Install applicable security updates and restart the device when required. Updates can address vulnerabilities that attackers might otherwise exploit to gain access to your system.

For business environments, test updates against critical applications and deploy them through an established patch-management process.

Review security notifications

Open Windows Security periodically to review protection status and alerts. Investigate warnings rather than dismissing them automatically.

Pay particular attention to unexpected changes in antivirus settings, suspicious application activity, and repeated attempts to access protected files.

Use least-privilege access

Avoid running everyday applications with administrator privileges unless necessary. A standard user account can limit the damage that certain compromised applications may cause.

For IT administrators, use separate administrative accounts and apply permissions according to job responsibilities.

Reduce common attack opportunities

Security settings work best when users also follow safe computing practices:

Avoid opening unexpected attachments, even when messages appear familiar.
Download software from trusted publishers and official sources.
Verify unexpected requests for passwords, payments, or sensitive information.
Remove applications and browser extensions that are no longer needed.
Use multifactor authentication for important accounts where supported.

These habits reduce opportunities for attackers to deliver malware or misuse compromised credentials.

Step 5: Create and Test Reliable Backups

Even with strong prevention, no endpoint security configuration can guarantee that ransomware will never succeed. Backups are therefore essential.

A useful approach is the 3-2-1 backup strategy:

Maintain three copies of important data.
Store those copies on two different types of storage or media.
Keep at least one copy off-site.

For ransomware resilience, go a step further: maintain a backup that attackers cannot easily modify or delete from a compromised computer. Offline, immutable, or appropriately isolated backups can provide additional protection.

Windows users may use supported backup options, external storage, or a managed cloud backup service, depending on their needs. Remember that ordinary file synchronization is not always equivalent to an independent backup. Deleted or encrypted files may also synchronize to another location.

Test your recovery process

A backup is only useful if you can restore the data.

Choose a small set of representative files and test recovery. For business systems, periodically perform documented restoration exercises that cover critical data, application dependencies, and recovery priorities.

IT teams should also establish recovery time objectives (RTOs) and recovery point objectives (RPOs). These define how quickly systems must be restored and how much data loss the business can tolerate.

Step 6: Verify That Your Configuration Works

After enabling protection, perform a configuration review instead of assuming everything is working.

Use this checklist:

Microsoft Defender Antivirus or an appropriate active antivirus solution is protecting the device.
Real-time protection and cloud-delivered protection are enabled where applicable.
Tamper Protection is enabled where supported.
Controlled Folder Access is enabled if appropriate for the environment.
Important folders are included in the protection scope.
Legitimate applications can access the files they need.
Windows and security intelligence updates are current.
Backups are available and restoration has been tested.

You can also review Windows Security’s protection history for relevant events.

For managed environments, consider using Microsoft Intune, Group Policy, or other supported endpoint-management tools to apply and monitor security settings consistently. Available controls depend on the Windows edition, management configuration, and organizational licensing.

Do not test ransomware protection by running real ransomware or downloading suspicious malware. Use controlled administrative validation and approved security-testing procedures instead.

Common Problems and How to Fix Them

Controlled Folder Access is missing or unavailable

Check that you are using a supported Windows configuration and that the active antivirus provider supports the relevant functionality. Organizational policies or third-party security products may affect which controls are available.

A trusted application cannot save files

Review Controlled Folder Access notifications and verify the application before allowing it. Where possible, use the application’s legitimate, signed executable and grant only the access required.

Protection settings keep changing

Check whether a security-management policy or another antivirus product controls the settings. On business devices, coordinate changes with the IT administrator rather than attempting to override centrally managed policies.

Files are encrypted despite protection being enabled

Disconnect the affected device from networks when appropriate to limit potential spread, notify your security team, and follow your incident-response plan. Preserve relevant evidence and investigate the entry point before restoring data. Do not assume that paying a ransom will recover the files.

Build a Stronger Ransomware Defense in Windows 11

Setting up ransomware protection in Windows 11 is straightforward, but effective security requires more than switching on a single feature.

Start with Microsoft Defender Antivirus, enable Controlled Folder Access where appropriate, keep Windows updated, restrict unnecessary privileges, and maintain backups that can survive a compromise. Then validate the configuration and review it regularly.

For home users, these steps provide a practical starting point. For IT professionals and solution architects, the next step is to standardize the configuration, deploy it through supported management tools, monitor security events, and test recovery procedures across the environment.

The most useful next step: Open Windows Security today, review your ransomware protection settings, and verify that your most important files can be restored from a reliable backup. Prevention reduces risk; tested recovery helps you respond when prevention is not enough.

Discover more from Dellenny

Subscribe to get the latest posts sent to your email.

Setting Up Ransomware Protection in Windows 11 – A Simple and Complete Guide

Why Ransomware Protection Matters in Windows 11

Step 1: Open Windows Security

Step 2: Enable Microsoft Defender Antivirus Protection