Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf a business email account is compromised, contact your IT or security lead through a trusted channel, contain the account, and revoke active sessions. Then check for ways the attacker could regain access, establish what was viewed or sent, and limit harm to recipients and the business. The exact controls differ by provider; the steps below describe Microsoft 365 where noted.
What should you do first?
- Stop using the account for sensitive actions. Do not use it to approve payments, change payroll details, reset other accounts, or send sensitive information while access is in doubt.
- Contact the organization’s IT administrator or security lead through a trusted channel. Do not rely on the potentially compromised mailbox. If there is no internal responder, contact the organization’s established IT or security provider.
- Contain the account using an administrator-controlled path. For Microsoft 365, Microsoft recommends disabling the affected account during the investigation. Reset its password through a trusted administrator path and revoke active sign-in sessions so stolen credentials or refresh tokens cannot continue to be used.
- Preserve evidence. Record when the compromise was noticed and retain suspicious messages, relevant logs, and details of unauthorized changes for responders. Avoid deleting messages or rules before the organization’s responders can preserve what they need.
A password reset by itself may not remove every way an intruder can keep access. The account should remain contained while responders check for other access methods and unauthorized changes.
As an Amazon Associate I earn from qualifying purchases.
How do you stop the attacker from returning?
For Microsoft 365, examine the account and mailbox for changes an attacker could use to keep access or monitor messages. Remove only changes that responders determine are unauthorized, and preserve their details first.
Recommended Free Tools
- Authentication: Review registered MFA devices and methods for unfamiliar additions.
- Connected apps and privileges: Review user-consented applications and permissions, and check whether the account was given an administrative role it should not have.
- Forwarding and inbox rules: Inspect mailbox forwarding settings and inbox rules, including hidden rules. Look for rules that forward or redirect mail externally, move messages out of view, or otherwise conceal activity.
- Account profile: Check for unusual profile or account-setting changes as part of the investigation.
External forwarding merits particular attention in Exchange Online: CISA’s Exchange Online baseline warns that “Adversaries can use automatic forwarding to gain persistent access to a victim’s email.” That guidance is specific to Exchange Online; other providers have different controls and procedures.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
How can you determine what happened?
Once the account is contained, investigate the period before suspicious activity through remediation. Logs can help establish activity and scope, but they may not identify the attacker conclusively.
- Review sign-ins. In Microsoft Entra, examine sign-in logs and risk reports for the relevant account. Note timestamps, IP addresses, locations, and whether attempts succeeded or failed.
- Review audit records. Check relevant records beginning immediately before the suspected compromise and continuing through remediation. Look for account, authentication, permission, mailbox, and forwarding changes.
- Check outbound mail. Inspect sent items and use message trace for the affected period to identify suspicious messages, recipients, and delivery activity.
- Check connected storage. A Microsoft Entra account compromise can also expose associated SharePoint folders and OneDrive files. Investigate those services for relevant access or changes.
- Build a timeline. Record suspicious sign-ins and changes, messages and recipients, data-access findings, containment actions, and the time each action was taken.
These are Microsoft 365 and Entra examples, not universal menu paths. Other providers may differ in whether they offer account blocking, session or token revocation, audit-log access and retention, mailbox-rule inspection, outbound-message tracing, and connected-storage logs. Use the affected provider’s administrator controls or ask its support team or your incident-response provider for the equivalent procedures.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C & NFC): The Thetis PRO-A features integrated USB Type C and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
How do you limit harm to customers, coworkers, and the business?
Use the investigation to identify suspicious messages and everyone who received them. Contact those people through a separate, trusted channel—not by replying to a message from the compromised account. Tell recipients what to do based on the message: for example, not to follow a link, share credentials, open an attachment, or act on a payment request.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf the incident may involve a wire transfer, invoice, payroll change, or other payment, contact the bank and business counterparty promptly using independently verified contact information. Preserve the relevant messages and transaction records for responders and any authorities involved.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Notification duties and reporting deadlines depend on the facts, jurisdiction, applicable contracts, and insurance terms. Check the requirements that apply to your organization with its legal adviser, regulator, insurer, and relevant authorities rather than assuming one deadline applies everywhere.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you restore and harden the account?
Restore normal access only when responders are satisfied that the account is under control and unauthorized changes have been addressed. Verify that the owner can authenticate safely, require MFA, and monitor sign-ins and mail activity after restoration.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
CISA advises businesses to require MFA on email, file storage, remote access, and privileged accounts, working with their IT team or provider. CISA’s guidance says “Strong passwords help, but they are no longer enough.” MFA reduces risk but does not make an account immune to compromise.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Compare MFA options before choosing a method
| Method | CISA’s relative guidance | Practical considerations |
|---|---|---|
| Physical security key | First in CISA’s listed preference order; its strongest listed option. | Check compatibility with the organization’s identity provider and employee devices, and define how access will be recovered if a key is lost. |
| Authenticator app with number matching | Second in CISA’s listed preference order. | Confirm supported devices and plan a secure replacement or recovery process. |
| App-generated one-time code | Third in CISA’s listed preference order. | Check identity-provider and device compatibility and how employees will regain access if a device is unavailable. |
| Biometrics | Listed after app-generated codes; usually used with another method. | Availability and setup depend on the employee’s device and the organization’s identity provider. |
| Text or email code | Last in CISA’s listed preference order; CISA describes these as the weakest options listed and recommends using them only when stronger methods are unavailable. | Use only if stronger compatible methods are unavailable, and establish a recovery path. |
CISA does not establish a universal compatibility or recovery procedure for every organization. Confirm both with your identity-provider administrator before changing employee authentication requirements. A physical security key is a hardening measure after containment, not a way to remove an intruder or investigate an incident.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L2 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Fully compatible with ID Austria, this hardware key meets the mandatory FIDO2 Level 2 (L2) security standard. Check FIDO2 compatibility before purchase - Known limitations: Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Improve readiness for the next incident
CISA recommends enabling logs on servers, firewalls, endpoints, and cloud services; monitoring for high-risk events; and protecting logs from unauthorized access or deletion. It also recommends designating a crisis-response team with technology, communications, legal, and business-continuity roles. Those responsibilities help the organization investigate quickly without overlooking customer communications, legal questions, or the ability to keep operating.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
