Step 1: Remove unused Windows features

1. Open Control Panel → Programs → Windows Features

2. Disable:

   • SMB 1.0

   • Legacy media features

   • Unused Internet components

Restart the system.

Step 2: Disable unnecessary services

1. Press Win + R → services.msc

2. Review services set to Automatic

3. Disable services you don’t use (example: Fax, Remote Registry)

Disable only one service at a time and test.

Step 3: Enable built-in exploit protection

1. Open Windows Security

2. Go to App & Browser Control

3. Enable Exploit Protection

4. Leave default system settings unless you understand overrides

Step 4: Enable Controlled Folder Access

This prevents ransomware from encrypting files.

1. Windows Security → Ransomware Protection

2. Enable Controlled Folder Access

3. Add allowed apps if something is blocked

Step 5: Use a non-admin user daily

• Create a standard user account

• Use admin account only for installations

This alone blocks many malware attacks.