Many of Windows Security’s advanced protection controls remain disabled by default due to compatibility concerns, but enabling these features, such as Memory Integrity and LSA protection, could dramatically improve security if properly configured.
Windows Security is often treated as a basic antivirus panel, yet it also contains several hardening features that can materially improve protection if they are switched on. In practice, some of the strongest controls are left disabled because they can interfere with older drivers, niche applications or unusual system configurations. Microsoft’s own documentation and recent reporting suggest that is by design: these are safeguards that trade convenience for a tighter security posture.
One of the most important is Memory Integrity, also known as Hypervisor-protected Code Integrity. Microsoft says it uses virtualisation-based security to check kernel-mode code and drivers before they are allowed to run in sensitive areas of Windows, reducing the risk of malicious code reaching the core of the operating system. The feature can be absent entirely if virtualisation is disabled in firmware, so users who do not see it in Windows Security may need to check UEFI or BIOS settings first. Microsoft also warns that compatibility problems can arise with some hardware and software, which is why it recommends backing up a PC before changing firmware settings.
A second layer worth checking is LSA protection, which Microsoft says helps stop untrusted software from running inside the Local Security Authority process or accessing its memory. That matters because the LSA is involved in sign-in handling and credential storage while a user is logged in, making it a valuable target for attackers looking to steal login material. Microsoft’s support documentation says the feature is enabled by default on supported devices, although it can still be turned on or off from the Windows Security app.
Smart App Control takes a more aggressive approach to software trust. Rather than simply scanning for known malware, it blocks apps that Microsoft cannot verify as safe, including unsigned executables. Microsoft has said the feature was originally restricted to clean installs of Windows 11, and once disabled it could not easily be re-enabled without reinstalling Windows. Reporting in 2026 indicates that this restriction has been relaxed for more PCs, including some upgraded systems, although the feature can still be intrusive for people who routinely test unfamiliar software.
Controlled folder access and potentially unwanted app blocking are also worth reviewing. Microsoft positions controlled folder access as a ransomware defence that prevents untrusted applications from altering files in protected locations such as Documents, Pictures and Videos. The same settings area also includes protection against potentially unwanted apps, which Microsoft says has been on by default since August 2021. Even so, users should expect some false positives, particularly with older utilities, lesser-known installers or specialist tools that have not yet built a strong reputation.
For most users, the practical approach is to enable these protections one at a time and test the system after each change. That makes it easier to identify which setting, if any, causes a driver issue or application conflict. The broader point is simple: a Windows 11 PC can appear fully protected while still leaving several important defences switched off. For older laptops, and especially for machines that were upgraded rather than freshly installed, it is worth opening Windows Security and checking what is actually active rather than assuming the defaults have done the job.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
