Despite built-in safeguards like Memory integrity and Smart App Control, many Windows 11 users leave these protections disabled, risking vulnerabilities. Experts advise enabling features cautiously to strengthen device security while ensuring compatibility.
Windows 11 users often leave Microsoft Defender’s stronger safeguards untouched, even though they are built into the operating system and available through the Windows Security app. The settings in question are Memory integrity, Local Security Authority protection, Smart App Control, Controlled folder access and potentially unwanted app blocking. Each can improve resistance to common attack methods, but Microsoft has deliberately kept them optional because they can interfere with older software, unsigned drivers and other legitimate applications.
That trade-off helps explain why a machine can look protected while still missing some of Windows 11’s more aggressive defences. Systems that were upgraded, rather than freshly installed, are especially likely to carry these features in an inactive state. A warning that the device may be vulnerable does not mean the computer has already been compromised; it simply indicates that a protection is not switched on. Before changing anything deeper, particularly BIOS settings, users should back up the machine first.
Memory integrity is one of the most important of these controls. It is Microsoft’s consumer-facing name for Hypervisor-protected Code Integrity, a virtualization-based safeguard that checks code before it is allowed to run in sensitive parts of the operating system. In practice, that makes it harder for malicious code to reach the kernel, which is the core of Windows. If the option is missing in Windows Security, the usual reason is that virtualization has been disabled in firmware. Microsoft’s documentation makes clear that Smart App Control and other modern protection layers rely on the Windows 11 security stack working as designed, including cloud-backed reputation checks and code integrity features.
Local Security Authority protection serves a different purpose. The Local Security Authority handles sign-ins and credentials while a user is logged in, which makes it an attractive target for attackers seeking account access. Microsoft says this protection blocks unsigned drivers and plug-ins from loading into that process. The downside is that older security tools or poorly signed components may stop working once the setting is enabled, so the safest approach is to turn it on one at a time and restart after each change.
Smart App Control is the strictest of the group. Microsoft describes it as a reputation-based feature that uses cloud intelligence and code integrity to decide whether an application is safe enough to run. It is meant to stop untrusted or unsigned software before it opens, rather than reacting after a threat has already launched. Microsoft’s support material says it can operate in an Evaluation mode, where Windows decides whether the feature can stay on without causing too much disruption. The company also says the feature is now available more broadly than it used to be, including on some upgraded Windows 11 installations, after previous limitations were relaxed in 2026.
Controlled folder access and potentially unwanted app blocking cover a more practical set of risks. Controlled folder access helps defend against ransomware by stopping untrusted applications from altering files in protected locations such as Documents, Pictures and Videos. When a trusted app is blocked by mistake, Windows records the event in Protection history and allows the user to permit it. Potentially unwanted app blocking targets software that may not be outright malware but still behaves badly, such as toolbars, bundled installers or ad-supported utilities. Microsoft says this protection has been on by default since August 2021, but users can still find it disabled, especially on older or customised systems.
The main lesson is that Windows Security is not just a virus scanner. It is a layered protection system, and some of its more valuable controls remain off unless the user deliberately enables them. For most people, the sensible method is to switch on one feature at a time, restart where required and watch for compatibility issues. That approach may take longer, but it makes it much easier to identify which setting affects a specific driver, application or workflow if something stops working.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
