Skip to main content

Microsoft offers some key advice for foiling ransomware attacks in Windows 11

Representational image of data security
(Image credit: Kingston)

Microsoft has asked users to enable Microsoft Defender for Endpoint's Tamper Protection feature to protect themselves against ransomware campaigns, as it released the final version of its security configuration baseline settings for Windows 11

Microsoft helps businesses swim through the ocean of security-related settings and tweakable parameters by providing guidance in the form of security baselines.

As part of its guidance for Windows 11, the software giant asked its users to enable the Tamper Protection feature to prevent threat actors from overriding the security features of the installation.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

“While you are enabling the Microsoft Security Baseline for Windows 11 (and/or Windows 10, and/or Windows Server 2022/2019/2016), make sure to enable Microsoft Defender for Endpoint's "Tamper Protection" to add a layer of protection against Human Operated Ransomware,” noted Microsoft security consultant Rick Munck.

Security compliance toolkit

Munck pointed users to the Microsoft Security Compliance Toolkit 1.0, which allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines, while comparing them against other security configurations.

As part of the release, Microsoft is suggesting users to enable Defender’s Tamper Protection functionality.

“Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring,” explains Microsoft.

Tamper protection works by ensuring Defender’s secure, default values are locked, and can’t be modified through the Registry Editor, PowerShell cmdlets, or via Group Policy, which are usually exploited by malware to disable the security protections.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.