The biggest correction is about encryption. Tom's Guide says the Windows setting is "BitLocker." On many PCs, especially Windows 11 Home, it isn't. Below, each item gets the Windows 11 steps Microsoft actually documents, plus what the setting does and doesn't protect you from.
1. Updates: on by default, but only on a supported Windows version
Tom's Guide says to turn on automatic updates or check by hand. Microsoft's Windows Update FAQ says Windows 11 already downloads and installs updates automatically. You can trigger a manual check at Settings > Windows Update > Check for updates. Some practical details:
- Restarts: Updates finish only after a restart. Windows tries to restart while you're not using the PC. You can also schedule the restart or set active hours.
- Pausing: You can pause updates for a while, but not forever. Once the pause limit is reached, Windows makes you install the latest updates before you can pause again.
- Metered connections: Microsoft says some updates won't install automatically on a metered connection. If you've marked your home Wi-Fi as metered, that may be why you're behind.
The bigger catch is the operating system itself. Microsoft says Windows 10 support ended on October 14, 2025. Since then, Windows 10 PCs get no free security fixes through Windows Update. "Keep your device updated" doesn't help much when no updates are coming. If you're still on Windows 10, upgrading should be first on this list.
Takeaway: On Windows 11, check that updates aren't paused and that you're not on a metered connection. On Windows 10, plan the upgrade.
2. Advertising ID: useful, but limited
Microsoft's privacy documentation puts the Windows 11 setting at Settings > Privacy & security > General, under a toggle about letting apps show personalized ads using your advertising ID. On newer Windows 11 builds this page is being replaced by a Recommendations & offers page, so your menu may look different.
Know what this toggle covers before you expect much from it:
- It only affects Windows apps that use the Windows advertising identifier.
- Microsoft says it doesn't cover other kinds of interest-based advertising, such as cookie-based ads on websites.
- Microsoft also says turning it off won't reduce how many ads you see. The ads may just be less relevant.
On Android phones with Google Play services, Google documents Settings > Privacy > Ads > Delete Advertising ID. On some older Android versions the control is called "Opt out of Ads Personalization" instead. Google adds that individual apps may have their own ad settings.
Takeaway: Turn it off, but it removes one identifier. It doesn't stop tracking in general.
3. Lock-screen notifications: protection from people nearby
Tom's Guide suggests turning off lock-screen notifications or hiding their previews, so people around you can't read sensitive messages or verification codes. That's reasonable, especially if your two-factor codes arrive by text message. It stops casual onlookers, not someone who already has your unlocked phone. Menu names differ between iOS, Android and phone makers, so look in your Notifications settings for options about previews or hiding content.
4. Location permissions: decide app by app
The advice is to allow location only while an app is in use. Google's Android help supports this. It lists four options per app:
- Allow all the time
- Allow only while using the app
- Ask every time
- Don't allow
Android can also give an app your approximate location instead of your precise one. Google describes approximate as an area of roughly 3 square kilometers. A weather app works fine with that, while a ride-hailing app needs precise location.
On Windows 11, Microsoft's app-permission controls are at Settings > Privacy & security, where you pick a permission such as Location and choose which apps can use it. Traditional desktop apps aren't listed there. Microsoft says the page doesn't show apps that have access to all system resources, and you can't use it to control them. The toggles on that page cover Store-style apps, not every program on the PC.
Takeaway: Choose "while using the app" by default, and turn off location entirely only for apps that have no need for it.
5. Lock your device, and make it lock by itself
Tom's Guide recommends a strong, unique password and locking quickly. Microsoft's device-security guidance goes further and recommends passwordless sign-in with Windows Hello where you can. The Windows steps:
- Go to Settings > Accounts > Sign-in options.
- Under Require sign-in, make sure Windows asks you to sign in when it wakes from sleep.
- Search for Sleep from the Start menu and set an idle timeout. Microsoft suggests 10 or 15 minutes as a common choice, but pick what suits you.
- Press Windows key + L to lock right away when you get up.
Microsoft points out that putting just the screen to sleep is enough to trigger the lock. Putting the whole PC to sleep also saves power.
Tom's Guide also warns against "trusted environment" features that keep a device unlocked near home or in your car. That's sensible caution, though the article doesn't name specific features, and not every device has one.
6. Unknown apps: Windows has a setting for this
Tom's Guide treats "block unknown apps" as one universal switch. Windows 11's version is at Settings > Apps > Advanced app settings > Choose where to get apps. Microsoft lists these options:
| Option | What it does | Who it suits |
|---|---|---|
| Anywhere | No restriction | Experienced users only |
| Anywhere, but let me know if there's a comparable app in the Microsoft Store | Suggests Store alternatives | Casual users |
| Anywhere, but warn me before installing an app that's not from the Microsoft Store | Warns before outside installs | Most people |
| The Microsoft Store only (Recommended) | Blocks outside installs | Family PCs, or anyone who never needs outside software |
Microsoft recommends the Store-only option. But if you rely on legitimate tools from developer websites, Store-only will just push you to switch the setting back off. The warn me option is a more realistic compromise for many people. Being in a store doesn't automatically make an app safe either.
7. Device encryption: Tom's Guide gets this one wrong
Tom's Guide says the Windows encryption setting is in Privacy & Security and is "called BitLocker." That's true on some PCs and wrong on many Home-edition laptops. Windows actually has two related features:
- Device Encryption is a simplified, automatic form of BitLocker. Microsoft's BitLocker documentation says it provides a simple way for some devices to enable BitLocker encryption automatically. It appears at Settings > Privacy & security > Device encryption and works on Windows 11 Home.
- BitLocker Drive Encryption is the full version with more controls. It's available on Pro, Enterprise and Education editions.
Some practical details from Microsoft's documentation:
- More PCs qualify now. Starting in Windows 11, version 24H2, the prerequisites of DMA and HSTI/Modern Standby are removed. As a result, more devices are eligible for automatic and manual device encryption.
- USB drives aren't covered. Device Encryption encrypts only the OS drive and fixed drives, it doesn't encrypt external/USB drives.
- Your recovery key is stored online. When Device Encryption turns on automatically, the recovery key is automatically backed up to Microsoft Entra ID, AD DS, or the user's Microsoft account. Microsoft also notes that if you sign in with only a local account, encryption isn't turned on automatically.
- Turning it off is permanent until you change it. If device encryption is turned off, it will no longer automatically enable itself in the future. The user must enable it manually in Settings
Before you enable it, know where your recovery key is. Changing firmware settings such as Secure Boot or TPM options can make Windows ask for the BitLocker recovery key. Forum threads are full of people who encrypted a drive, changed a firmware setting, and then couldn't find the key. Encryption stops thieves from reading your data, but it will lock you out too if the key is lost.
On the Mac side, Tom's Guide names FileVault. Menu locations vary between macOS versions, so check the one for your release.
8. Firewall: usually on already, so leave it on
Tom's Guide says Microsoft Defender Firewall is probably already on, and that's usually true. To check, open Settings > Privacy & security > Windows Security > Firewall & network protection, where you'll see the domain, private and public network profiles. Microsoft's guidance is clear: if the firewall blocks an app you need, allow that one app instead of turning off the firewall. On work PCs your IT department may control these settings anyway.
For Macs, Tom's Guide says the macOS firewall is off by default and points to System Settings > Network > Firewall. Treat the exact menu as dependent on your macOS version.
A firewall blocks unwanted connections. It doesn't protect you from a malicious program you chose to install, which is why items 1 and 6 matter as much as this one.
9. VPN: a separate tool, not a setting
Tom's Guide acknowledges that a VPN isn't really a setting and recommends Proton VPN's free tier. A VPN hides your traffic from the local network and your internet provider, which helps on hotel or coffee-shop Wi-Fi. It doesn't remove malware, stop websites tracking you through cookies or accounts, or make you anonymous. Whichever provider you pick, you're moving your trust from your internet provider to the VPN company. Think about whether that trade suits you before treating a VPN as a must-have.
10. Browser permissions and Safe Browsing
The final item is to set site permissions such as microphone, camera, location and automatic downloads to "ask first," and to turn on your browser's Safe Browsing feature. Menu names differ between Edge, Chrome and Firefox. Windows also has its own layer: Microsoft documents Windows Defender SmartScreen at Settings > Privacy & security > Windows Security > App & browser control. Microsoft says SmartScreen sends data about the sites you visit and files you download to Microsoft so it can warn you about dangerous ones. That's a privacy cost, but for most people the protection is worth it.
The bottom line
The Tom's Guide list is worthwhile, and the "corporations are spying on us" message at the end is fair enough, but none of these settings makes a device fully secure. Each one closes a specific gap.
Here's the list in a sensible order for a Windows user:
- Make sure you're on a supported version of Windows 11 and updates aren't paused.
- Check Device Encryption or BitLocker, and confirm you can find your recovery key.
- Set a short sleep-to-lock time, and use Windows Hello or a strong password.
- Set app installs to warn you about anything from outside the Microsoft Store.
- Confirm the firewall is on and SmartScreen is enabled.
- Then work through the privacy settings: advertising ID, location and browser permissions.
The whole thing takes about 15 minutes, less time than a typical Windows feature update.