Laptops have a harder life than desktops. They sit in cafés and libraries, ride around in backpacks, and get left on airport seats, which gives a thief or a nosy stranger far more chances to get at them. XDA Developers' Tanveer Singh recently made this point in a checklist of four built-in Windows 11 security settings that many owners never turn on or never check: Controlled folder access, Dynamic lock, device encryption and Tamper Protection.
The advice is sound. Two parts of the original article need correcting, though, and Microsoft's own documentation adds limits and recovery steps that matter in practice. Below, each feature is set against what Microsoft says it actually does, with steps to turn it on and the common problems to watch for.
Why these settings matter more on laptops
Each feature covers a different risk:
| Feature | Main threat it addresses | What it does not do |
|---|---|---|
| Controlled folder access | Untrusted apps (including ransomware) changing files in protected folders | Protect the whole drive, replace antivirus, or encrypt anything |
| Dynamic lock | You walk away from an unlocked laptop | Lock instantly, or stop someone already using the PC |
| Device encryption (BitLocker) | Someone pulls the drive out of a lost or stolen laptop | Stop malware on a running, unlocked PC, or stop a thief wiping the device |
| Tamper Protection | Malicious apps switching off Microsoft Defender Antivirus settings | Lock every security control on the system |
Summary: these four settings work together. None of them replaces another, and none makes a laptop immune to attack.
Controlled folder access: a guard for your files
Ransomware usually gets in the ordinary ways. Microsoft lists unsafe or fake websites, unexpected email attachments, and malicious links in email, social media and chat messages. Controlled folder access (CFA) adds a check on top of Microsoft Defender's standard scanning.
According to Microsoft's support documentation, CFA checks apps against a list of known, trusted apps. Untrusted or unsafe apps are blocked from accessing or changing files in protected folders, and Windows Security notifies you when it blocks something. By default it protects Documents, Pictures, Videos, Music and Desktop, and you can add your own folders. The original XDA list left out Desktop.
A correction. The XDA article says CFA protects critical boot sectors from boot-level ransomware, and on this point it is broadly right: Microsoft's CFA documentation describes disk-sector protection as part of CFA — by default it blocks untrusted apps from writing to the disk sectors holding the boot record, to counter bootkits and disk-wiper malware. Think of CFA as a guard posted at specific folders, plus the boot record's sectors. It still does not encrypt or scan the whole drive.
How to turn it on
- Open the Windows Security app (or search for "ransomware protection" from Start).
- Go to Virus & threat protection.
- Under Ransomware protection, select Manage ransomware protection.
- Switch Controlled folder access on.
- Optionally, use Protected folders to add other locations, such as a folder where you keep tax files.
Common problems
- A legitimate app gets blocked. Microsoft suggests noting the app's path and adding it under Allow an app through Controlled folder access. Be careful who you let in: Microsoft warns that any allowed app can access protected files, and if that app is ever compromised, those files are at risk.
- You can't save a file to a protected folder. Microsoft says this means the app is blocked from that location. Save the file somewhere else, allow the app, then move the file back.
- Recovery. The same Ransomware protection page offers OneDrive-based ransomware data recovery. CFA is designed to block attacks, so a backup is still essential.
Summary: CFA is worth turning on, especially on a laptop you also use for work. Expect to approve a few trusted apps early on.
Dynamic lock: a backup for forgetful people
Dynamic lock uses your phone as a proximity sensor. Microsoft Learn describes it as locking a Windows 10 or 11 device when a paired phone's Bluetooth signal falls below a set Received Signal Strength Indicator (RSSI) value.
How to set it up
Setup has two parts. You first need to pair a Bluetooth device (such as your iPhone or Android phone) to the computer, and then you have to enable Dynamic Lock in the Settings app.
- Turn on Bluetooth on both the phone and the laptop.
- In Windows, go to Settings > Bluetooth & devices, select Add device, choose Bluetooth, and pair your phone.
- Go to Settings > Accounts > Sign-in options.
- Expand Dynamic lock and turn on Allow Windows to automatically lock your device when you're away. As a recent WindowsForum guide notes, depending on your build, this is a check box or a toggle.
XDA gives the path as "Account" (singular). The current label is Accounts.
What success looks like, and the limits
Test it by walking out of range with your phone. Microsoft's support guidance says the PC locks within a minute after you leave Bluetooth range. Guides such as Geek Rewind's say it only locks the PC. It never unlocks it when you come back, so you still sign in the usual way. The same guide warns that switching off Bluetooth on the phone, or letting the phone's battery die, looks the same to Windows as walking away, so the PC will lock.
The more important limit is in Microsoft's enterprise documentation. Dynamic lock locks the device only when the Bluetooth signal drops and the system is idle. If someone starts using the laptop before that happens, it won't lock. Microsoft calls Dynamic lock an additional barrier that does not replace locking the computer yourself.
Microsoft also says RSSI measurements are relative and depend on the environment, so walls, crowds and your phone's Bluetooth radio all change how far away the trigger point is.
Troubleshooting: if Dynamic lock doesn't appear or is greyed out, check that the phone is actually paired and that the laptop's Bluetooth adapter is working. On work or school PCs, IT may manage the setting. Microsoft documents both Group Policy and Intune controls for Dynamic lock.
Summary: Dynamic lock is a useful backup. In a café, a minute is plenty of time for someone to get in, so keep pressing Windows key + L whenever you get up.
Device encryption: confirm it's on and back up your key
XDA says most new laptops ship with device encryption turned on. According to Microsoft, the details matter. Device Encryption uses BitLocker to encrypt the operating-system drive and fixed drives, and it is available on more devices than full BitLocker Drive Encryption, including Windows Home. It turns on automatically when you first set up or sign in with a Microsoft account or a work or school account, and the recovery key is attached to that account. With a local account, it does not turn on automatically. If you set up your laptop with a local account, it may not be encrypted.
How to check and enable it
- Sign in with an administrator account.
- Go to Settings > Privacy & security > Device encryption.
- If it's off, switch it on.
If Device encryption doesn't appear, Microsoft says the feature is either unavailable on that device or you're signed in as a standard user. To find out why:
- Search Start for System Information, right-click it and choose Run as administrator.
- In System Summary, find Automatic Device Encryption Support or Device Encryption Support.
- Read the reason shown. "TPM is not usable" means there is no TPM or it is disabled in firmware. "WinRE is not configured" means the Windows Recovery Environment isn't set up. "PCR7 binding is not supported" means Secure Boot is off, or peripherals such as a docking station or external graphics card are connected during boot.
What encryption protects against
Microsoft says that if someone removes the drive and connects it to another computer, the data is unreadable without the decryption key. XDA calls this protection absolute. A more accurate description is that encryption makes offline access to your data far harder. It does nothing against malware running on an unlocked laptop, and a thief can still wipe the device and sell it.
Back up the recovery key now
This is the step most people skip. Microsoft describes the BitLocker recovery key as a 48-digit number that you need when BitLocker can't unlock the drive automatically, which can happen after hardware or firmware changes. Microsoft Support cannot retrieve or recreate a lost key. To make a backup, search Start for Manage BitLocker and choose Back up your recovery key. You can save it to your Microsoft account, a USB drive or a file, or print it. Microsoft warns against keeping the USB drive or printout with the laptop, because a thief who has both can get past the encryption.
Summary: check that encryption is actually on, and make sure you can reach your recovery key before you need it.
Tamper Protection: protecting Defender itself
Tamper Protection deals with an obvious problem: malware can try to turn off the security settings that would catch it. Microsoft says the feature helps stop malicious apps from changing important Microsoft Defender Antivirus settings, such as real-time protection and cloud-delivered protection. Administrators can still change those settings in the Windows Security app. Other apps can't.
A second correction. XDA says Tamper Protection stops apps from changing your machine's "security infrastructure." Microsoft describes something narrower: it protects Defender Antivirus settings, not every security control in Windows. Microsoft also notes that it doesn't affect how third-party antivirus works or registers with Windows Security.
How to turn it on
- Open Windows Security > Virus & threat protection.
- Under Virus & threat protection settings, select Manage settings.
- Switch Tamper protection on.
On work or school devices, the organisation may manage this setting. Ask IT if it's greyed out.
What to do
On a new Windows 11 laptop, you can work through all four settings in about ten minutes:
- Turn on Controlled folder access, and only allow apps you trust.
- Pair your phone and turn on Dynamic lock, but keep locking the laptop yourself.
- Check that device encryption is on, particularly if you used a local account, and back up the recovery key somewhere other than the laptop.
- Confirm Tamper Protection is on.
XDA's article is a good starting point. Microsoft's documentation adds the limits: each feature closes off one route an attacker could use, and none of them covers everything.
Correction (October 20, 2026): an earlier correction in this article wrongly claimed Microsoft's controlled folder access documentation says nothing about boot-sector protection. It does — by default CFA blocks untrusted writes to the disk sectors holding the boot record, to counter bootkits and disk-wiper malware.