Ransomware Protection: Windows PC & Server Guide

This guide shows you how to harden a Windows PC or server against ransomware, the malware that encrypts your files and demands payment. You’ll learn the essential configuration changes, backup strategies, and user habits that block most attacks. The steps are practical and can be completed in about an hour, using built-in Windows tools plus a few free downloads.

What You’ll Need

• Administrator access to the Windows device
• A separate external drive or cloud storage for backups (not always connected)
• Optional: a free or paid antivirus/anti-ransomware tool (Windows Defender is enough for basic protection)

Step-by-Step

1. Enable and update Windows Defender. Go to Settings > Privacy & Security > Windows Security > Virus & threat protection. Click “Manage settings” under Ransomware protection and turn on “Controlled folder access.” This blocks unauthorized apps from modifying your Documents, Pictures, and other protected folders. Ensure virus definitions are updated (Settings > Update & Security > Windows Update).
2. Turn on system restore and create a restore point. Press Win+R, type sysdm.cpl, go to the System Protection tab, select your system drive, click Configure, and enable protection. Then click Create and name it (e.g., “Before config”). This lets you roll back system files if ransomware hits.
3. Enable file history or backup to an external drive. Go to Settings > Update & Security > Backup and add a drive. Turn on “Automatically back up my files.” For servers, use Windows Server Backup (add the feature via Server Manager) and schedule daily backups to a separate disk or network location that is not always mapped.
4. Restrict PowerShell and scripting. Ransomware often uses PowerShell. Open PowerShell as admin and run: Set-ExecutionPolicy Restricted. For servers, disable Windows Script Host via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Script Host > Set “Restrict” to Enabled).
5. Disable macros in Office. In Word/Excel, go to File > Options > Trust Center > Trust Center Settings > Macro Settings, and select “Disable all macros without notification.” This stops malicious macros that download ransomware.
6. Enable email attachment filtering. If you use Outlook, add a rule to move emails with executable attachments (.exe, .scr, .js) to Deleted Items. For servers with Exchange, use transport rules to block these file types.
7. Set user permissions to least privilege. Do not use an administrator account for daily work. Create a standard user account (Settings > Accounts > Family & other users) and use it for email and browsing. For servers, ensure users only have read/write access to folders they need.
8. Enable network-level authentication (NLA) for RDP. If you use Remote Desktop, go to System Properties > Remote, and check “Allow connections only from computers running Remote Desktop with Network Level Authentication.” This reduces brute-force attacks.
9. Install an anti-ransomware tool. Windows Defender includes ransomware protection, but you can also install a dedicated tool like Malwarebytes Anti-Ransomware (free). Keep it updated and run a full scan weekly.
10. Patch the system regularly. Enable automatic updates (Settings > Update & Security > Windows Update > Advanced options > Automatic). For servers, set up a maintenance window to install updates monthly.
11. Implement a backup rotation scheme. Use the 3-2-1 rule: three copies of data, on two different media, one offsite. For example, keep the external drive disconnected after backup and use a cloud service like OneDrive or Backblaze.
12. Test your backups. Once a month, restore a few test files from backup to a separate folder to ensure they are not corrupted.

Common Mistakes

• Leaving the backup drive connected after backup – ransomware can encrypt it too.
• Disabling User Account Control (UAC) for convenience – this allows silent installs.
• Clicking “Enable Content” on Office documents without checking the source.
• Using the same password for local accounts and not enabling multi-factor authentication (MFA) for cloud services.
• Ignoring Windows Update for weeks – unpatched vulnerabilities are the top entry point.
• Not testing restores – you only find out backups are broken when you need them.

Tips

• Use application whitelisting (e.g., Windows Defender Application Control) on servers to only allow approved executables.
• Enable “Tamper Protection” in Windows Security to prevent malware from disabling Defender.
• For critical servers, consider using a read-only domain controller (RODC) or a separate backup domain.
• Educate users to hover over links before clicking and to verify sender email addresses.
• Use a standard, non-admin account for everyday tasks – this alone blocks many infections.
• Keep a bootable rescue disk (like Windows Defender Offline) ready for emergencies.

Troubleshooting

If you suspect ransomware has infected your system, act immediately:

• Disconnect from the network – unplug the Ethernet cable or turn off Wi-Fi to stop the spread.
• Do not pay the ransom – there is no guarantee you’ll get your files back, and it funds crime.
• Restore from backup – if you have a clean backup, wipe the system and reinstall Windows, then restore files.
• Use Windows Defender Offline – boot from a USB with Windows Defender Offline to remove the malware before restoring.
• Check for file extensions – if files have .encrypted or .locked extensions, it’s likely ransomware.
• Contact a professional – for servers, engage a cybersecurity expert or incident response team.

If a backup fails to restore, try using Shadow Explorer to recover previous versions of files (if System Protection was enabled).

Frequently Asked Questions

Can Windows Defender alone protect against ransomware?

Windows Defender with Controlled folder access and cloud-delivered protection is effective for home users, but no single tool is 100% foolproof. Combining it with good backups and user habits is essential.

What is Controlled folder access?

It’s a Windows Security feature that prevents unauthorized apps from modifying files in protected folders like Documents and Pictures. You can add custom folders to protect.

How often should I back up my data?

For critical data, back up daily. For less critical, weekly is a minimum. The more frequent, the less data you lose if ransomware hits.

Is it safe to pay the ransom?

No. Paying encourages attackers and doesn’t guarantee decryption. Law enforcement agencies advise against paying. Focus on prevention and backups.

Does ransomware affect servers differently than PCs?

Servers often have more sensitive data and are always on, making them prime targets. They also require extra measures like network segmentation and stricter access controls.

Can I recover files without a backup?

Sometimes, if the ransomware hasn’t deleted shadow copies, you can use Shadow Explorer. But modern ransomware often deletes them. Backups are the only reliable recovery method.

Related

• Fix HP Laptop Slow Startup? Steps That Work
• Msvcr80.dll Missing on Windows? Fix It Now
• How to Run Two Apps Side by Side on iPhone