Windows 11’s security posture is stronger than most casual users realize — but “strong” is not the same as “optimal.” The defaults Microsoft ships increasingly favor convenience, cloud recovery, and compatibility over the tightest possible security posture, and that trade-off can leave gaps for privacy-minded users and power environments. This chapter excerpt from Paul Thurrott’s De‑Enshittify Windows 11 lays out a clear, practical path to harden a new or existing Windows 11 installation: keep account choices and device encryption front and center, accept the real benefits of Microsoft account sign‑in for most users, enable a handful of built‑in protections such as Smart App Control and Controlled Folder Access, remove redundant third‑party suites, and tune Windows Update and app update behavior so patches arrive on your terms. The steps are straightforward, but the tradeoffs — especially around cloud recovery and telemetry — deserve scrutiny and precise configuration. rview
Microsoft has steadily improved Windows 11’s security stack over multiple releases: BitLocker‑style disk encryption is now widely available, Windows Hello biometrics are hardened by hardware protections, Smart App Control offers app reputation‑based execution control, and the platform’s update cadence remains predictable with monthly security rollups and optional preview updates. Paul Thurrott’s “De‑Enshittify” chapter synthesizes those features into a practical checklist for everyday users: choose the right account model for the right reasons; make sure device encryption is truly active and the recovery key is accessible; enroll and harden Windows Hello; enable ransomware mitigations; and remove vendor junkware that weakens rather than strengthens protection. That playbook is sensible, targeted, and designed for low‑risk application by typical users — but it also acknowledges the reality that Microsoft’s cloud‑centric defaults introduce privacy tradeoffs even as they improve recoverability and resilience.
Accounts: Mlocal account — the security tradeoffs
Why the account you choose matters
Choosing between signing in with a
Microsoft account or a
local account is the single biggest security decision you make during OOBE (Out Of Box Experience). Signing in with a Microsoft account enables several valuable protections automatically:
- Two‑factor / passwordless flows (passkeys and second‑factor enrollment) become available for your account.
- Windows creates a device‑bound passkey used for seamless authentication to built‑in services (OneDrive, Microsoft Store, Edge sign‑in, etc.).
- Device encryption (the consumer Devocker workflow) is frequently enabled by default at setup, and the recovery key is backed up to your Microsoft cloud account or, for work/school devices, to Entra (Azure AD). This ensures you can recover access if something goes wrong.
- OneDrive Folder Backup (a.k.a. Known Folder Move / Folder Protection) is typically configured to protect Desktop, Documents, and Pictures, giving you both ransomware resilience and a cross‑device copy of your files. Microsoft documents the feature, and the OneDrive client exposes a straightforward Manage backup flow.
In contrast, a local account avoids cloud nudges and some telemetry by design, but it brings clear security deficits:
- It can’t be protected with Microsoft account passwordless flows or cross‑device passkeys.
- It may be created without a password on some OEM setups (an immediate, avoidal accounts do not receive automatic cloud backup of BitLocker recovery keys or OneDrive folder protection unless you take additional manual steps.
Put simply: for most users who are willing to accept a measured cloud tradeoff, a Microsoft account delivers far better default security out of the box. For privacy‑obsessed users who must avoid cloud hooks entirely, a local account is a valid choice — but only if you compensate with careful manual configuration (strong local password, manual BitLocker setup and secure key storage, manual backups).
Practical recommendation
- If you want the most secure, low‑effort setup: sign in with a Microsoft account, enable Windows Hello and two‑factor authentication, and verify your BitLocker recovery key is stored in your account.
- If you insist on a local account: create a strong password, then enable BitLocker and export the recovery key to a secure location (USB / local vault / corporate key escrow for enterning Windows 11 Home, you’ll be forced to pair with a Microsoft account for the simplest device encryption workflow; Windows 11 Pro lets you use BitLocker control panel options to store keys elsewhere.
Device encryption and recovery keys — what really happens
Defaults and the cloud backup
Recent Windows 11 releases and the Copilot+ initiative tightened defaults so that
Device encryption is commonly turned on when you sign in with a Microsoft, work, or school account after a clean install. When enabled this way, the OS will back up the 48‑character recovery key to your Microsoft account or to Entra (Azure AD) for managed devices. This behavior makes disk recovery and device population significantly more resilient for the typical user.
Microsoft’s published guidance confirms that BitLocker or Device encryption keys are available via your account dashboard when you need them; independent press coverage documents Microsoft’s move to enable device encryption more widely in consumer scenarios. That combination (official doc + independent reportage) verifies the practical effect: default encryption plus cloud key backup for Microsoft‑signed setups.
Home vs. Pro differences
- *evice encryption is designed to be as painless as possible; however, the simplest cloud backup option is a Microsoft account. If you use a local account on Home, Windows will require you to sign in with a Microsoft account to finish enabling automatic Device encryption, or nd flow‑throughs (temporary Microsoft sign‑in, then conversion).
- Windows 11 Pro: You have access to the classic BitLocker Drive Encryption control panel. That allows more flexible key backup targets (USB, AD, printed key) and BitLocker To Go for removable media. Use Pro if you need more administrative control over key escrow.
Action ite encryption is On: Settings > Privacy & security > Device encryption. If on, verify a recovery key exists in your Microsoft account.
- If you use a local account on Home: temporarily sign in with a Microsoft account to finish encryption and key backup, then convert back if required.
- If you use Pro and prefer not to store the recovery key in the cloud: open BitLocker control panel and back up the key to a USB drive or print it for safe offline storage.
Windows Hellecurity (ESS), and Copilot+ hardware
Windows Hello basics
Windows Hello (face, fingerprint, PIN) is faster and more secure than passwords when properly enabled. The PIN is locally bound to the device and Windows hello uses hardware security to protect biometric templates. These are industry‑standard benefits you should use wherever available.
Enhanced Sign‑in Security (ESS)
ESS is a hardware‑backed hardening layer for Windows Hello that isolates biometric matching and keys inside virtualization‑based security (VBS) and the TPM. Microsoft’s documentation explains that ESS requires specialized biometric hardware, appropriate drivers and firmware, and VBS‑capable platform features. When present, ESS significantly reduces the risk that a compromised kernel or user process can exfiltrate biometric templates or spoof logins.
Notably,
Copilot+ PCs (Microsoft’s new AI‑optimized hardware family) include ESS by default where the OEM supplies the necessary hardware, and Microsoft documents that all Copilot+ PCs enable stronger platform protections (Pluton, SDEV tables, VBS defaults). That makes Copilot+ hardware —
parapdragon X‑series Arm devices — a compelling choice for buyers prioritizing secure, always‑on hardware isolation and NPU acceleration for AI features. Independent coverage and Microsoft’s Copilot+ announcement describe the platform requirements and the early device ecosystem.
Practical tips
- Enable Windows Hello and, where availabometric modalities** (face + fingerprint) to reduce lockout failure modes.
- If your device supports ESS, leave it enabled — it’s an automatic security win. Verify in Windows Security > Device security.
Windows Security: Smart App Control, Controlled Folder Access, and other features
Windows Security aggregates the OS’s most important protections into a single control surface. Don’t ignore its recommendations: the app flags missing protections and lets you enable key defenses with a click.
Smart App Control (SAC)
- What it is: An AI‑driven, cloud‑backed app reputation and execution blocklist that runs in evaluation or enforcement mode. After a clean install, SAC usually starts in evaluation mode and either promotes itself to enforcement or turns itself off depending on detected usage patterns. Microsoft’s docs describe the lifecycle and behavior in detail.
- Practical stance: For most consumers and non‑developer users, enabling SAC aggressively increases protection against unsigned, malicious, or low‑reputation binaries. Developers and certain enterprise workflows may require exceptions. Recent previews indicate Microsoft is improving toggling behavior so SAC can be more flexible in Insider builds.
Controlled Folder Access (ransomware protection)
- What it is: A folder‑level control that prevents unauthorized apps from modifying protected folders (Desktop, Documents, Pictures, Music, Videos are protected by default). It’s part of Windows’ ransomware mitigationed to add extra folders or allow trusted apps. Microsoft documents both the consumer and Defender for Endpoint management planes for this feature.
- Practical stance: Enable it. Run in Audit mode first if you have a complex workflow to catch false positives, then switch to enforcement and selectively allow trusted developer tools when required.
Remove third‑party security suites — carefully
Many OEMs ship trialantivirus or “security” bundles that duplicate the platform’s protections while adding subscription nags, background processes, and fragile uninstallers. Removing these can reduce system friction and eliminate telemetry and popups that offer little security benefit. Thurrott recommends uninstalling them and relying on Windows Security for built‑in protection unless you have a specific reason to use a third‑party product.
What to expect and how to do it safely
- Use Settings > Apps > Installed apps and the Control Panel’s “Uninstall a program” for visible suites. Many vendors also publish removal tools (McAfee MCPR, Bitdefender uninstall utility) to clean leftover drivers and scheduled tasks. Community guides and vendor docs provide step‑by‑step instructions; the Windows Package Manager (winget) is a repeatable option for scripted removals.
- Windows Security will re‑activate Microsoft Defender Antivirus automatically if no other registered antimalware provider remains; Microsoft documents this behavior. If Defender does not re‑enable, vendor remnants or group policy settings are usually the cause and should be cleaned.boot and verify Windows Security shows Real‑time protection active, and check Security providers to ensure Defender is the active antivirus. If not, run the vendor removal tool again or use vendor guidance to remove lingering services and drivers.
Keep Widate — but control reboots and bandwidth
Windows Update still follows the long‑standing cadence: the monthly security cumulative (Patch Tuesday) arrives on the
second Tuesday of each month, and Microsoft offers optional preview releases in the fourth week (“Week D”) for early adopters. Microsoft’s IT‑focused guidance and community documentation describe this cadence and the optional preview channel behavior. Thurrott’s recommendations about configuring restart notifications and delivery optimization reflect good operational hygiene: don’t let the system surprise you with reboots, and avoid peer‑to‑peer update bandwidth surprises on limited networks.
For app updates:
- Use the Microsoft Store for store apps (Store > Downloads > Check for updates).
- Use winget (Windows Package Manager) or the new Store CLI to update non‑Store apps in bulk; this is the most comprehensive, scriptable approach for keeping third‑party software patched. Thurrott specifically recommends winget for a weekly sweep.
Recommended Windows Update settings (per Thurrott’s checklist):
- Turn Get me up to date Off so Windows doesn’t rush updates and restart immediately.
- Turn Notify me when a restart is required On so you control reboots.
- Set Active hours to reflect your working day.
- Disable Allow downloads from other devices (Delivery Optimization) if you want to avoid local network bandwidth surprises.
A concise, ordered hardening checklist (do this now)
- At OOBE: sign in with a Microsoft account unless you have a strict offline requirement. This gives you passkeys, automatic Device encryption, OneDrive folder backup, and recovery key escrow.
- Confirm Device encryption is On and validate the BitLocker recovery key is present in your Microsoft account (or save it offline if you prefer Pro control).
- Enroll Windows Hello (PIN + biometrics) and enable Enhanced Sign‑in Security (ESS) if available. Check Windows Security > Device security for ESS entries.
- Open Windows Security and accept recommended actions; enable Smart App Control (or leave it to finish evaluation), and enable Controlled Folder Access (start in Audit mode if you run developer tools).
- Remove OEM third‑party AV trials and bloatware, then verify Microsoft Defender is active. Use vendor cleanup tools if needed.
- Configure Windows Update advanced options (no auto rush to update; notify on reboot; tune active hours; disable delivery optimization). Schedule a weekly winget update sweep for third‑party apps.
Critical analysis — what's good, what's risky, and what to watch
Strengths
- Hardware + software hardening is real: Copilot+ hardware, Pluton processors, ESS, VBS, and TPM practices materially raise the cost to attackers for credential and biometric theft. Microsoft’s documentation and Copilot+ hardware announcements confirm this direction. For buyers, the Qualcomm Snapdragon X‑series Copilot+ devices combine strong hardware isolation with excellent battery life and NPU performance for AI workloads.
- Encryption and recovery are finally usable by default: The move to back up recovery keys automatically for Microsoft‑signed devices removes a longstanding human error vector (lost keys), improving post‑compromise resilience. Independent reporting corroborates Microsoft’s rollout of this default behavior.
- Integrated defenses (SAC, Controlled Folder Access, Defender AV) provide layered protection without additional subscription costs, and the Windows Security dashboard makes activation straightforward.
Risks and tradeoffs
- Cloud key escrow vs. privacy: Backing BitLocker recovery to a Microsoft account is a huge usability win, but it centralizes a critical recovery secret in the cloud. Users who must avoid cloud storage for regulatory or privacy reasons must explicitly handle keys offline — a process that is less convenient and more error‑prone.
- Enforced defaults can surprise power users: Features like Smart App Control are strict in enforcement mode; developers or administrators may find legitimate workflows blocked. Historically, SAC was once difficult to re‑enable without a clean reinstall — Microsoft is improving this but the potential friction remains. Make sure to evaluate SAC in your environment before rolling it into production. ([learn.microsoft.comsoft.com/en-us/windows/apps/develop/smart-app-control/overview)
- OEM bloat and uninstall friction: Vendors sometimes ship nested security modules (e.g., McAfee components and browser extensions) that are difficult to fully remove without vendor removal tools. Incomplete removals can leave stale provider registrations that prevent Defender from activating. Expect to use vendor cleanup tools or winget for a thorough uninstall.
- Dynamic update behavior: Microsoft’s use of Controlled Feature Rollout and CFR means two identical machines can show different features and behaviors at the same time. That unpredictability complicates test matrices for power users and IT admins and is a continuing operational risk. Thurrott’s chapter calls out CFR as a source of unpredictability; administrators should favor predictable update rings in managed environments.
Final verdict and practical guidance
Windows 11’s security baseline is strong and continues to improve. Microsoft has moved to make device encryption, hardware‑backed biometrics, and app‑reputation controls accessible to mainstream users, and Copilot+ hardware accentuates those gains with stronger platform protections. For most users, the pragmatic path to the best tradeoff of convenience and security is to sign in with a Microsoft account, enable Windows Hello, confirm Device encryption and recovery key backup, turn on Smart App Control and Controlled Folder Access, uninstall the clumsy third‑party suites, and take control of update timing and app patching with winget.
Power users and privacy‑first operators should still be cautious: if you must avoid cloud escrow or telemetry entirely, plan compensating controls and safe key handling — and accept the added operational complexity. Finally, document your choices: know where your recovery keys live, maintain an offline copy if required, and verify Defender and controlled protections are active after any major system change. These steps reduce both the chance and the impact of compromise while keeping your system manageable and responsive.
If you follow the checklist above you will have a Windows 11 installation that is both secure and practical: encrypted, biometrically hardened where hardware allows, protected from known bad apps, and under your control when it comes to updates and reboots. That is the pragmatic goal of De‑Enshittify: not to eliminate Microsoft’s cloud choices, but to choose the secure defaults for you and to understand and manage the tradeoffs when you don’t.
Source: Thurrott.com
De-Enshittify Windows 11: Make Windows 11 More Secure