The reliable way to protect Windows systems from ransomware is defense in depth: patch every internet-facing component, use Microsoft Defender and Controlled Folder Access, require phishing-resistant multifactor authentication, remove unnecessary administrator rights, limit RDP and SMB exposure, segment critical systems, and keep encrypted backups that ransomware cannot reach. Test those backups by restoring files and complete systems before an incident.
The same controls apply to a home PC and a business server, but servers need tighter identity controls, network containment, service hardening, and documented rebuild procedures. If ransomware is suspected, isolate the affected equipment without destroying evidence, investigate the entry path, rebuild or clean only when integrity is known, and restore from a verified copy. Paying does not guarantee that files will be returned.
As an Amazon Associate I earn from qualifying purchases.
What ransomware protection has to accomplish
Ransomware usually becomes catastrophic when one compromised account or device can reach many files, systems, and backups. Protection therefore has four separate goals:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prevent the initial compromise: close known vulnerabilities, protect credentials, and reduce exposed services.
- Limit what malware can execute or modify: use Defender, application controls, least privilege, and folder protections.
- Contain movement: segment networks and restrict administrative paths so one endpoint cannot reach every server.
- Recover without negotiating: maintain isolated, encrypted copies and rehearse restoration.
No single setting is a complete defense. A patched computer can still be infected through a stolen password; a well-configured endpoint can still lose data if its backup is mounted and writable; and a backup is not a recovery plan until a restore has been demonstrated.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Build the baseline on every Windows PC
1. Patch Windows, applications, and exposed infrastructure
Install current security updates for Windows and the applications that handle email, documents, browsers, remote access, and administration. Give priority to known-exploited vulnerabilities on internet-facing systems. This includes VPN appliances, remote-management tools, email servers, firewalls, and other network devices, not just the desktop operating system. CISA describes timely patching as one of the most efficient and cost-effective ways to reduce exposure.
Use automatic updates where they are appropriate, but do not treat an automatic setting as proof that every device is current. Managed environments should maintain an inventory, define a maximum patch age for internet-facing systems, and verify installation. Retire software that cannot be patched or isolate it behind compensating controls.
2. Turn on Microsoft Defender protections
Keep Defender signatures and automatic protection enabled. In an organization, manage policy centrally and protect that policy against unauthorized changes. Tamper-resistant management matters because attackers commonly try to disable security tools after gaining a foothold.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview alerts rather than silently excluding files or folders. An exclusion that solves a compatibility problem can also create an unmonitored path for ransomware. If an exception is unavoidable, document its owner, reason, scope, and review date.
3. Enable Controlled Folder Access
Controlled Folder Access (CFA) in Microsoft Defender allows only trusted applications to change files in protected folders, adding a barrier against ransomware. Microsoft describes it as a feature that helps protect files from ransomware threats.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Open Windows Security.
- Select Virus & threat protection.
- Under Ransomware protection, select Manage ransomware protection.
- Turn on Controlled folder access.
- Review the protected folders and add important local or network data directories that are not included by default.
Test representative applications before enforcing CFA broadly. In managed environments, start in audit mode when available, review which legitimate programs would be blocked, and then move to blocking mode after compatibility is understood. Add an application only when its publisher and behavior are trusted; allowing every program defeats the control. CFA can block legitimate software and can affect applications that write to network shares, so monitor events and performance during a pilot.
4. Protect accounts and reduce privilege
Require phishing-resistant multifactor authentication for email, VPN access, remote administration, and privileged accounts. Passwordless methods or cryptographic security keys based on FIDO2/WebAuthn are options where the service supports them; use the strongest method your identity platform can enforce.
Separate everyday work from administration. Users should have a standard daily account and a separate administrator account, with administrative credentials used only for tasks that require them. Remove unnecessary local administrators, review membership in privileged Active Directory groups, and apply least privilege to service accounts as well as people. A stolen administrator token can turn one infected PC into an enterprise-wide incident.
5. Reduce remote-access and file-sharing exposure
Do not expose Remote Desktop Protocol (RDP) directly to the internet. Put remote administration behind a protected access path, require MFA, restrict source networks, and record administrative activity. Remove unused remote-management software and close firewall rules that no longer have a business purpose.
Review SMB exposure in the same way. Disable SMBv1 after checking application dependencies and move compatible systems to SMBv3.1.1. Older software that requires SMBv1 should be isolated and assigned a documented replacement plan rather than left as a permanent exception.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
6. Add application controls when the environment can support them
Application allowlisting through Windows Defender Application Control (WDAC) or AppLocker can prevent unapproved executables and scripts from running. Endpoint detection and response (EDR) adds centralized telemetry, alerting, and response actions. These controls require testing, policy ownership, and staff who can investigate events; deploy them where compatibility and operational capacity are sufficient rather than enabling a policy nobody can maintain.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Hardening a Windows server
Servers deserve stricter controls because they often contain shared data and have connectivity to many other systems. Apply the workstation baseline, then add containment and recovery measures specific to server roles.
Prioritize internet-facing server paths
Patch internet-facing services quickly, including VPN infrastructure, email systems such as Exchange, web applications, and network devices that provide access to the server network. Inventory listening services and remove roles that are not required. Restrict management interfaces to administration networks or approved jump hosts instead of allowing broad access from user subnets.
Segment critical systems
Place file servers, domain controllers, backup systems, and other critical services in network segments with explicit firewall rules. A workstation should not be able to initiate unrestricted connections to every server, and a file server should not have unnecessary outbound access. Segmentation limits lateral movement when an endpoint or credential is compromised; it is not a substitute for patching or MFA.
Harden SMB and administrative access
Disable SMBv1 once dependencies have been identified and remediated, and prefer SMBv3.1.1. Restrict administrative shares and server-management protocols to the networks and accounts that need them. Use separate administrator identities, review Active Directory group membership regularly, and remove stale accounts and permissions. Keep RDP off public interfaces and require protected access with MFA for remote administration.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Protect server workloads and data paths
Use CFA or equivalent endpoint policy for server data directories when the server role and applications are compatible. Pilot the policy with production-like workloads because a blocked service can interrupt business operations. Consider WDAC/AppLocker and EDR for servers that hold sensitive data or provide high-value services, with central policy and alert handling.
Prepare to rebuild
Maintain a known-good golden image or a documented rebuild procedure for each critical server role. Record required operating-system updates, application installers, configuration, certificates, service accounts, dependencies, and the order in which systems must return. A rebuild plan is especially important when an attacker may have altered system files or administrative tooling; cleaning a compromised server without confidence in its integrity can reintroduce the attacker.
Design backups that ransomware cannot erase
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario. Ransomware often searches for accessible backups, so a backup that is always mounted with ordinary user credentials is not an independent recovery copy.
Use more than one recovery location
Keep at least one encrypted copy offline or otherwise isolated from routine credentials. An encrypted external hard drive or SSD can serve this role when it is disconnected after the backup job and stored securely. Capacity and interface depend on the amount and change rate of your data. For a business, a backup or disaster-recovery service may provide isolated or immutable copies, but verify retention, geographic availability, restore guarantees, and who controls deletion credentials.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Versioned storage, such as a versioned cloud location for user files, can help recover earlier copies when appropriate. It should complement—not replace—an independent offline backup for critical data. Synchronization can reproduce deletion or encryption, while an offline or isolated copy preserves a separate recovery point.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Encrypt and separate backup credentials
Encrypt backup media and protect encryption keys separately from the data. Use dedicated backup credentials with only the permissions required to perform and restore jobs. Do not let ordinary workstation administrators delete every backup target. If a provider supports immutable retention, configure it according to the period your organization needs and protect the account that can change retention.
Test both files and complete systems
- Choose representative files from each critical workload and perform a restore to a clean location.
- Verify that restored files open correctly, permissions are appropriate, and databases or applications pass their own integrity checks.
- Schedule a full-system or server recovery using a golden image or documented rebuild process.
- Record how long recovery took, which dependencies were missing, and who must approve each step.
- Update the recovery order and contacts after every exercise.
A successful backup job reports that data was copied; it does not prove that the copy is usable. Test availability and integrity on a schedule, including after major changes to applications, identity systems, or storage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when ransomware is suspected
Speed matters, but careless actions can destroy evidence or spread the incident. Use this sequence and adapt it to your incident-response plan.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Isolate the suspected device. Disconnect it from wired and wireless networks, or use managed network isolation, in a way that does not unnecessarily destroy volatile evidence. If a server is affected, isolate adjacent systems when lateral spread is possible.
- Call the incident-response lead. Bring in the people responsible for security, infrastructure, legal obligations, communications, and business recovery. Do not let an individual user negotiate or wipe systems alone.
- Preserve evidence. Save ransom notes, filenames, timestamps, relevant endpoint alerts, authentication records, firewall logs, and backup activity. Record which systems were isolated and when.
- Find and close the entry path. Investigate exposed services, stolen credentials, malicious email, unpatched software, or remote-access rules. Reset potentially exposed credentials, including service and administrator accounts, using a clean administrative workstation.
- Choose cleaning or rebuilding deliberately. Scan and clean with trusted tools only when you can establish system integrity. Rebuild from known-good media or a golden image when compromise of system files, administrative tools, or credentials cannot be ruled out.
- Restore after containment. Confirm that the environment is clean, the exploited access path is closed, and the selected backups predate the compromise or are otherwise known-good. Restore in the documented order, monitor for renewed suspicious activity, and rotate credentials as systems return.
Do not assume that paying will recover data. Microsoft Support states: “Don’t pay money to recover your files. Even if you were to pay the ransom, there is no guarantee that you’ll regain access to your PC or files.” Payment also does not remove the vulnerability or stolen-credential path that allowed the incident.
Choose protection tools by outcome, not by feature count
When comparing endpoint products, backup services, or managed security offerings, assess the controls that determine whether an attack is contained and recoverable.
| Evaluation area | Questions to answer |
|---|---|
| Protection scope | Does it cover one PC, a server role, or an entire fleet? Are remote and intermittently connected devices included? |
| Recovery assurance | Are copies offline, isolated, or immutable? Can you perform file and full-system restores, and are those tests documented? |
| Administration and alerting | Who receives alerts, investigates them, approves exclusions, and can isolate a device or revoke credentials? |
| Compatibility impact | Will CFA, allowlisting, or backup agents interfere with line-of-business applications, network shares, or server performance? Is there an audit or pilot mode? |
| Identity and endpoint integration | Can the control use your Microsoft identity, MFA, device-management, and logging systems without creating new unmanaged administrator accounts? |
| Total cost | Include licensing, storage, retention, implementation, staff time, restore testing, and the cost of downtime—not just the advertised subscription. |
Common mistakes that undermine ransomware defenses
- Backing up to a permanently connected disk: ransomware can encrypt or delete it using the same credentials as the host.
- Skipping restore tests: an incomplete backup, expired encryption key, or missing application dependency may not be discovered until recovery is urgent.
- Leaving RDP or SMB broadly reachable: exposure gives stolen credentials and malware a direct route into valuable systems.
- Using one administrator account for everything: compromise of that account removes the separation between daily work and high-impact changes.
- Enabling CFA without a pilot: legitimate applications may be blocked, prompting users to request broad exclusions or disable the feature.
- Treating cloud synchronization as the only backup: synchronization and version history are useful, but critical data still needs an independent offline or isolated copy.
- Ignoring old SMBv1 dependencies: disabling the protocol without checking applications can cause outages, while leaving it enabled indefinitely preserves an avoidable risk.
- Restoring before containment: if the attacker still has access, restored systems can be encrypted again.
A practical maintenance schedule
Ransomware readiness is an operating routine rather than a one-time configuration.
- Continuously: keep Defender protection active, collect endpoint and authentication alerts, and isolate devices that show suspicious encryption or credential activity.
- Each patch cycle: verify Windows, applications, VPNs, Exchange or other internet-facing services, and network devices are updated; review failed installations.
- Regularly: review local administrators, privileged Active Directory groups, RDP rules, SMB exposure, CFA events, application allowlisting decisions, and backup job results.
- On a defined schedule: restore sample files and conduct a full-system or server recovery exercise. Update the recovery order, contacts, golden images, and documentation from the results.
- After major changes: repeat compatibility tests for CFA, WDAC/AppLocker, EDR, and backup agents whenever applications, server roles, identity systems, or network segmentation change.
The objective is measurable: fewer reachable attack paths, fewer accounts with excessive privilege, a contained blast radius, and a recovery copy that has been proven usable. If those conditions are maintained, ransomware becomes an incident to contain and recover from rather than a demand that determines whether the business can operate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
