Ransomware is malicious software that can encrypt company files and interrupt business operations. For Windows 11 users, the strongest protection comes from several layers: patched devices, reliable backups, phishing awareness, limited permissions and built-in security features. This practical checklist explains what to enable and what to do if something suspicious happens.
Step 1: Check that Microsoft Defender is active
Open Start → Settings → Privacy & security → Windows Security → Open Windows Security. Select Virus & threat protection and review your security provider and current protection status. If your organization uses another centrally managed antivirus, follow its IT policy rather than enabling competing real-time scanners.
Under Virus & threat protection settings, select Manage settings and verify that real-time protection is enabled when Microsoft Defender Antivirus is your active provider. Tamper Protection helps protect supported Defender settings from unauthorized modification.
Step 2: Keep Windows, browsers and applications updated
Go to Settings → Windows Update, select Check for updates, and install applicable security updates. Restart if prompted. Also update your web browser, PDF reader, Microsoft 365 apps and frequently used business software. On company-managed PCs, follow the approved patch schedule.
Step 3: Turn on Controlled folder access where appropriate
Windows Security includes a ransomware-focused feature called Controlled folder access, which can block unauthorized apps from making changes in protected folders. It is available when the required Microsoft Defender Antivirus protection is active, and it may be managed by organizational policy.
Open Windows Security → Virus & threat protection → Ransomware protection → Manage ransomware protection. Review Controlled folder access. If you are authorized to manage the device, you can enable it and test your regularly used apps.
| Windows Security area | What to verify |
|---|---|
| Virus & threat protection | Security provider and current protection status |
| Manage ransomware protection | Controlled folder access setting |
| Protection history | Blocked or detected activity to investigate |
Important: Controlled folder access may block legitimate software until it is explicitly allowed. Review protection history and approve trusted apps only after verification. It does not replace backups or enterprise security monitoring.
Step 4: Create backups ransomware cannot easily change
Maintain regular copies of important documents using an approved backup solution. Follow the 3-2-1 approach where practical: three copies, on two kinds of storage, with at least one isolated or offline copy. For businesses, add immutable or otherwise protected backups and test restoration regularly.
Cloud sync is useful for collaboration, but it is not the same as a protected backup: infected or encrypted files may sync too. Microsoft OneDrive version history and file recovery features can sometimes help, but they should not be your only recovery plan. See our OneDrive troubleshooting guide for general sync issues.
Step 5: Recognize malicious email attachments and links
Be wary of unexpected invoices, password reset messages, shared documents, ZIP archives and urgent payment requests. Before clicking a link, inspect the sender and destination; verify unusual requests through a trusted contact method. Do not enable Office macros or run scripts simply because an email asks you to.
If a message looks like an internal request but seems unusual, confirm with the colleague using an established phone number or company chat rather than replying to the suspicious message. Report it using your organization’s phishing-reporting procedure.
Step 6: Limit administrative rights and protect accounts
Use a standard user account for normal work; reserve administrative privileges for approved maintenance. Enable multifactor authentication (MFA) where available, especially for business email, remote access and administrator accounts. Use a password manager and never reuse passwords across important systems.
Step 7: Avoid unsafe downloads and remote-access tools
Install apps only from your organization’s approved software catalog or the manufacturer’s official site. Do not run unknown email attachments or unexpected PowerShell scripts. Remote-access applications can be legitimate, but an unsolicited caller asking you to install one is a warning sign.
Step 8: Know the early warning signs
Possible ransomware indicators include suddenly inaccessible documents, unexpected file extensions, ransom notes, widespread file renaming and security alerts. Not every slow computer or failed file-open operation is ransomware, so preserve evidence and involve IT promptly rather than guessing.
Step 9: Respond safely if you suspect an infection
On a company device: Notify your IT or security response team immediately and follow the organization’s incident-response plan. If instructed and safe, disconnect the affected computer from Wi-Fi and wired networks to limit potential spread. Do not attach backup drives, erase logs or attempt a self-service cleanup before investigators have assessed the situation.
For a personal computer, disconnect network access if you reasonably suspect active encryption, avoid using connected backup storage, and consult reputable incident-response guidance. Recovery decisions depend on the malware, available backups and whether the device is still compromised. Do not assume that paying a ransom will restore data.
Step 10: Test recovery before an emergency
A backup that has never been restored is an unverified backup. Periodically restore sample files to an isolated location and confirm that permissions, filenames and file contents are correct. Businesses should also test full-system recovery, responsible contacts and offline access to recovery instructions.
Quick checklist
| Protection | Recommended check |
|---|---|
| Endpoint protection | Active, monitored and updated |
| Windows and apps | Security patches installed |
| Controlled folder access | Evaluated and enabled where appropriate |
| Backups | Isolated copies and tested restores |
| Employee awareness | Suspicious links and attachments reported |
| Identity security | MFA and least privilege |
| Incident response | IT contacts and isolation steps known |
Frequently asked questions
Does Microsoft Defender guarantee protection from ransomware?
No. Modern endpoint protection can reduce risk, but no antivirus guarantees prevention. Layered defenses and tested backups remain essential.
Is OneDrive enough to recover from ransomware?
No. Sync tools can propagate file changes and deletions. Use a separate protected backup strategy; evaluate version history as an additional recovery option.
Should I enable Controlled folder access on every business PC?
Evaluate compatibility and organizational policy first. Some legitimate apps need explicit allow rules, and enterprise IT may manage the setting centrally.
Official references
Microsoft: Protect your PC from ransomware; Enable controlled folder access. Also consult CISA StopRansomware for organizational readiness and response planning.