When it comes to computers, you can never have too much security,
at least in my opinion. So in this video, I'm going to go over a bunch of different Windows
features and settings related to security that I think you should enable right away,
at least if you have the ability to. There are a couple that are exclusive to Windows Pro editions,
although I'll try to mention those. And there's also a few that are more optional or only
applicable in certain circumstances, and I'll mention those towards the end.
So we can start off strong with one of my favorites which is Windows Sandbox. And this
one I do believe requires Windows 10 Pro or Windows 11 Pro. So basically to enable this,
what you do is go to the start menu and then search for "Turn Windows Features On or Off",
and then open that up and you'll have a bunch of different optional Windows features.
You don't want to go and enable all of these, most of them are not necessary,
but one you can enable is Windows Sandbox. For this,
you might also need to enable Windows Hypervisor, I'm not 100% sure on that,
but so if it doesn't work, try enabling that one as well. So after you check the box and hit Ok,
it will then go and install it, and you will need to restart the computer for it to fully apply.
But after it does you can then search in the start menu for Windows Sandbox
and then you can create a shortcut on the desktop or whatever. And when you click it,
you'll see it basically brings up a virtual machine of a fresh install of Windows.
And this is completely separate and isolated from your current installation.
So what you can do is if for example, you download a program that you think is kind suspicious
you want to see and make sure that it is what it says it is, you can actually copy files,
and if you copy to the clipboard and then you can paste it into the virtual machine, and it will
go in there. And then you can run it within that, and do whatever and it'll be completely isolated.
Now in this example, I just copied over a image file that I can show you,
you can set as the background, for example. And by the way, I actually made this wallpaper.
I'll put the link in description if you want to check it out. And it also does not have
many programs installed. So I tried searching for Microsoft Edge, the default browser.
I didn't even see it in there. So there might be some restrictions, probably just
for security purposes. Anyway, whenever you're done doing whatever you want to test in there,
when you close out the window, it will tell you, "Hey, this is going to basically discard
everything that was in there and erase it."
So if you do agree to that and close it out, then if you start Windows
Sandbox again, it'll be completely fresh and anything you did in the previous thing
was completely gone. I'm sure you can think of some possible uses.
All right the next feature is actually a set of features called Exploit Protection.
So also with this one, you go to the start menu, type in Exploit Protection
and just click on that and it will take you to that window in the security settings for
Windows. Now in Windows 11, it seems that pretty much all of these were enabled as default.
But I believe if I remember in Windows 10 I had to enable some of these.
So either way, just go in here and basically enable all the ones that
you see here that are enabled. And it may say "Use Default On", that's fine.
The only one that I would not use by default is the one that says "force image randomization".
Apparently that one can sometimes cause issues if the program itself doesn't really support it.
So that one is probably fine to say "Use Default Off". And basically what these
settings do is just protect you against different techniques and strategies that
malware may use to get around security settings. Now going into more detail
than that would probably be its entire own video. So I'm not going to get into that,
but just know that if you enable these, your computer is going to be more secure.
You'll also notice a tab for individual program settings. And this is why I wouldn't worry about
that one being disabled by default, because if you see, I have some here such as Adobe Acrobat,
where you open it up and then in the override settings,
it has enabled that one for this particular program. And I did not set this, by the way.
So it seems like Windows will automatically enable that exploit protection anyway,
if the program supports it. Because I didn't enable any of these myself,
I think Windows did it automatically, as long as you're using the default option,
which should be on. But again, on Windows 10 you might have to enable them yourself.
Before we continue though, I want to thank today's sponsor, Karma. Karma is a free app
and browser extension I've found helpful that provides you a smart shopping experience with a
bunch of cool features for over 50,000 stores. For example, when buying something online,
usually I'm the type that goes and spends a bunch of time trying to find coupon codes.
But now with karma, it can automatically scan the web for potential coupon codes
and try them for you automatically. I mean paying full price?
In this economy? Not a chance. You can also earn what's called Karma Cash,
where you earn real money cash back when you make purchases at thousands of retailers.
And it's not a gimmick either, you literally can withdraw to your PayPal account later. Or
alternatively, you can choose to donate the cash to a nonprofit organization of your choice. And of
course, with this video being about security and by extension privacy, I'm happy to say
Karma will not sell your personal information to third parties, which is really important for me.
As for other cool features, you can save any of the products from
other stores to one centralized shopping list. And even choose to be notified in real time
if it drops in price. Or if it was sold out, you can be notified immediately if it comes back in
stock. Which will come in handy because I can't even buy more of my favorite shirt right now.
Karma is available as a browser extension for Chrome and Firefox, as well as an app for iOS
and Android. So you're totally covered. So if you want to join over 3 million shoppers using Karma,
then check out the link down in the description so you can get it either as an extension or an app.
And with all that being said, let's continue. OK so the next feature is called Application Guard.
And to enable this one, you also go into that same Turn Windows Features On or Off, and then look
for where it says Microsoft Defender Application Guard. And again check the box, click OK and then
restart when it asks you to. Now I've gotten mixed messages on this one. I've read that in Windows
10 it requires the Pro Edition, but maybe in Windows 11 it does not, I'm not 100% sure on this.
So your mileage may vary, it might be available to you, maybe not.
But if you do see it, you can enable it. And yes, I'll explain what it does in a second.
But one more thing you need to do to use it is to actually go to the Microsoft Store
and install the companion app. So I don't know why this is the case, but you do need to
install a separate app along with the feature. And I'll put that link down the description.
But basically once you install the feature and the companion app, when you open up Microsoft Edge or
another browser, I'll get to that in a second. It basically allows you to open
a new Application Guard window, which is kind of like, you can think of it like a
sandboxed browser window, kind of like how we did the whole Sandbox Windows feature.
So the idea is I guess it just opens an isolated browser. So if you go to a website that is
a bit suspicious, and it tries to do some kind of, I don't know, drive by attack or exploit in there,
then it is a lot less likely to be able to get out of the browser and do other
stuff. So it just creates a window that is more secure than the regular browser.
Now if you don't usually use Microsoft Edge, they also have browser extensions for Chrome
or any chromium based browser, and Firefox. So you install that and then it basically just
adds a little button that allows you to launch a new Application Guard window from any browser
instead of having to first launch edge and then launch the Application Guard.
And it still will open in Edge. Like Edge is the thing that runs the Application Guard window,
but that's just how that works. Still, in any case though, no matter how you launch it,
still good to know about this if you want to add a little bit more security when going to a certain
site. OK moving on, we have several different settings that I'll just kind of grouped together.
And to get to all these, go to the start menu and search "Reputation Based Protection". And then
in this window, I would basically just enable all of these. There's not really any reason to
not have all these enabled. The only downside is maybe occasionally you might get warned if you
download a program that isn't commonly downloaded, but you probably want to have that enabled anyway.
That's kind of the whole point, is it will warn you. And of course, you can always override
this warning if you want manually. But it's good to have that warning in first place.
In any case though, I would at least enable the one that talks about
Smart Screen for Microsoft Edge and the one with Phishing Protection.
And this is even if you don't use Microsoft Edge as your browser. And that's because again,
Microsoft actually has browser extensions that allows you to take advantage of these protections
that are normally just for Edge in any browser you want. So to do that, you go to the Chrome
Web Store and to search for the one that's called Microsoft Defender Browser Protection.
And after you install it, it's just automatic passive in the background. And you can see they
do have a little demo page, where if you go to a website that is flagged from Microsoft,
and detected as being malicious, then theoretically it should pop
up a block window to warn you about that. And apparently it does do a really good job,
at least when it was first released, which admittedly was way back in 2017.
But even apparently back then, it blocked way more phishing attempts than Chrome
and Firefox did. It was like 99% versus these other figures.
Now maybe the other browsers improved that over time, but it's not like it's either-or, it's
in addition to those other browsers protection. So there's really not any reason to not have this.
So I like to have that extra layer. OK, so one more of the features you definitely should enable
is Memory Integrity. So to do this, go to start menu and search "Core Isolation", and then you'll
see this checkbox for Memory Integrity. Now this is one you may or may not be able to enable
depending on whether your computer supports it and what CPU features you have, and also
what drivers are installed. Because it does have some restrictions on what drivers are supported.
But basically I would just try to enable it if you have the option there,
and if it lets you, awesome. If it doesn't, not a huge deal. And basically what this
does is just makes it harder for malware to access code in different parts of memory that
it's not really supposed to. Again, I don't really want to make a whole thing about how this works
exactly, it just does increase the security of your computer significantly. All right so
next up we have a few features that maybe you want to enable depending on your preference or
circumstances. So the first one is Bitlocker drive encryption. Now I would probably only
bother enabling this if you are using a laptop, that you like, take outside your house and stuff.
If you are doing that, I definitely would encrypt the hard drive. Because if you have
it stolen or lost, then you don't want people being able to access all your data. Obviously,
that would be really bad. That's a lot less likely that someone's
going to break into your house and steal your whole desktop computer.
Definitely still possible just, you know, less likely. Anyway, to enable this though,
you go to the start menu search for "Manage Bitlocker" and then you can simply go to the drive
you want to enable this on encrypt, and hit turn on Bitlocker. You can do this either on
secondary drives or the main drive, where as you boot it up it'll require some kind
of authentication, or it may just be tied to the Windows Login so it's not a huge inconvenience.
Now I believe sometimes this does require Windows 10 Pro, although I seem to remember
that if it is a laptop then you might be able to enable it if it isn't even Pro,
although it might be a more limited version of the feature. So just kind of be aware that.
No matter what though, just be 100% sure you back up the key in as many places as you can.
So that means do all the options, print it out, save it to a file that you keep externally
somewhere and safe, and also it'll probably give the option to save it to your Microsoft account,
or it may say Azure Active Directory account, depending on
what kind of account you're using. So I would just really use all three. Because if you do lose
that recovery key and for some reason you need to like take out the drive, put it in somewhere else,
then you're not going to be able to access that data if you need to recover it.
Kind of similar to that one I'll mention is the find my device feature. So you can just
go into the start search Find My Device, and this is kind of a similar thing.
I can't enable this because I use a local account, it's on my desktop anyway. Again,
this is probably if you're using a laptop, if there's a chance to lose it, you might just want
to enable this and then you'll be more likely to be able to find it if it is lost or stolen.
All right now the final feature you might want to enable is under the
settings for ransomware protection. So again just go to the start menu,
search for that and the feature we're looking for is called Controlled Folder Access.
And this is totally optional because it can be annoying sometimes, it's a trade off.
Basically what this does is it restricts which programs can access certain folders and change
them. So the default ones are all the libraries, so that would be your documents, music, pictures
and videos folders. And basically no program will be able to change those directories or anything in
them unless you explicitly allow it. And will warn you if something does try to change something.
So for example, I opened up notepad even, and then tried to save a file by even creating a
new folder. And you can see this thing popped up saying, "Hey, there's this program trying to make
a change in the documents directory", which is protected by a Controlled Folder Access and it
gets blocked. And then you have to go and allow it and then it'll be added to the allowed list.
So you can see how this might be kind of annoying. But the idea is that because ransomware is a thing
these days, then what that does is goes and encrypts everything on your hard drive. And the
idea is if there are certain folders that are more important that can't even be changed at all, it'll
be blocked from at least changing those, although it's going to be inconvenient for everything
else. Or at least until you go and basically add exceptions for all the programs you use normally.
Now you can add any folders you want to this, so if you have other folders you want to protect,
you can. The only downside to this feature that I think is really annoying, is you cannot remove
any of the default folders, which are the documents ones I just mentioned.
Which is so annoying because I barely even store stuff in my Documents folder.
Although a lot of programs use it for settings and stuff. So I have it disabled because
I was just getting bombarded by block requests,
and it was just more annoying than it was worth for me. So definitely one to just be
aware of and it'll be a personal preference. Still with knowing about all these features,
if you enabled some of them that weren't before, your computer should be a little bit more secure
than it was a minute ago. Thanks again to Karma for sponsoring this video.
Again, check out the link down the description so you can download
the browser extension or app and get your smart shopping experience going.
If you guys enjoyed this video, give it a thumbs up and if you want to keep watching,
the next video I'd recommend is one where it's talking about the difference between
Windows Server and other versions of Windows. If you did know about that, I'll put that link right
there. So let me know what you think down in the comments, if you want to subscribe,
you can check out the rest of my channel to do that. So thanks so
much for watching everyone, and we'll see you in the next video.