Microsoft offers some key advice for foiling ransomware attacks in Windows 11

Representational image of data security
(Image credit: Kingston)
Audio player loading…

Microsoft has asked users to enable Microsoft Defender for Endpoint's (opens in new tab) Tamper Protection feature to protect themselves against ransomware (opens in new tab) campaigns, as it released the final version of its security configuration baseline settings for Windows 11 (opens in new tab)

Microsoft helps businesses swim through the ocean of security-related settings and tweakable parameters by providing guidance in the form of security baselines.

As part of its guidance for Windows 11, the software giant asked its users to enable the Tamper Protection feature to prevent threat actors from overriding the security features of the installation.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window (opens in new tab) <<

“While you are enabling the Microsoft Security Baseline for Windows 11 (and/or Windows 10, and/or Windows Server 2022/2019/2016), make sure to enable Microsoft Defender for Endpoint's "Tamper Protection (opens in new tab)" to add a layer of protection against Human Operated Ransomware,” noted (opens in new tab) Microsoft security consultant Rick Munck.

Security compliance toolkit

Munck pointed users to the Microsoft Security Compliance Toolkit 1.0, which allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines, while comparing them against other security configurations.

As part of the release, Microsoft is suggesting users to enable Defender’s Tamper Protection functionality.

“Bad actors like to disable your security features to get easier access to your data, to install malware (opens in new tab), or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring,” explains (opens in new tab) Microsoft.

Tamper protection works by ensuring Defender’s (opens in new tab) secure, default values are locked, and can’t be modified through the Registry Editor, PowerShell cmdlets, or via Group Policy, which are usually exploited by malware to disable the security protections.

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.