Windows setup essentials: the first 30 settings to change (Windows 11)

A practical, no-fluff checklist for a new Windows PC or fresh install—30 settings to review first for security, privacy, update control, performance, and everyday usability (with quick “where to find it” paths).

The defaults of a new Windows install may not be in your best interests in terms of privacy, security, bandwidth, and overall day-to-day workflow. Here are the first 30 things you should check (or change) on a brand-spanking-new Windows 11 PC—and Windows installations in general.

TL;DR

• Protect yourself first: turn on System Protection (restore points), device encryption/BitLocker, and lock the Windows Security settings (including Tamper Protection).
• Reduce noisy defaults: tighten Diagnostics & feedback, disable Advertising ID, and turn off Activity history.
• Make updates less annoying: set Active hours, know about Pausing updates (and when not to), and tune Delivery Optimization (especially upload limits).
• Usability and user-agenda improvements: set your default apps, use the speedier app clean-up, tidy up the Start menu and the taskbar, show file extensions, and control the Startup apps.
• Verify as you go! After each section of this article, use “How to verify” notes so you’ll know if your setting stuck.

Before you change settings: two minutes that can save hours

1. Make sure to install any Windows Updates that are pending, just once, at Settings/configure Windows Update so you’re not just chasing moving menu items and bug fixes.
2. Confirm if you’re using an admin account (Settings/configure Accounts/Your info). Some settings will only be visible to Admin users.

If it’s a work/school PC, some settings will be locked down by IT (you’ll see messages like “managed by your organization”). Don’t fight policy—ask IT first.

The first 30 settings to change (quick list)

1) Enable System Protection and create a restore point

Restore points are a fast “undo” button for bad drivers, app installs, or system setting changes. Windows doesn’t always enable System Protection by default, so it’s worth checking on a new PC.

1. Press Windows key, type: systempropertiesprotection.exe and open it.
2. Select your system drive (usually C:), then choose Configure.
3. Select Turn on System Protection and allocate a reasonable max usage (many people start around 3–10% depending on drive size).
4. Select Create… and make one manual restore point (name it something like “Fresh setup”).

• How to verify: Re-open System Protection and confirm Protection shows as On for (C:).
• Common mistake: Turning it on but setting max disk usage to nearly zero—Windows won’t keep useful restore points.

2) Turn on Device encryption or BitLocker (and secure your recovery key)

Disk encryption protects your data if your PC is lost, stolen, or repaired by someone else.Many newer Windows 11 laptops offer “Device encryption” (common on Home edition), while Pro/Enterprise can use BitLocker more explicitly.

1. Visit your: settings > privacy & security > device encryption (if you see it) > turn it on.

If you don’t have device encryption (or you’re on windows Pro), type in start: manage BitLocker and enable BitLocker on your OS drive.

Make sure to back up that recovery key to a password manager and/or your ms account and/or offline printout either.

How to Check if it’s Secure: Your settings > device encryption should show on; or in manage BitLocker “OS drive” should show encrypted.

Common Mistake: Saving that recovery key on the same PC you just encrypted.

3) Bruise Windows Security basics (Defender), Firewall, tamper protection

Even if you’re planning on installing a 3rd party antivirus on day 1 later, your goal for day one is simple: ensure the built-in protection is working and extremely difficult to tamper with. In windows security, you are making sure ms defender antivirus and firewall are both on; and that Tamper Protection is as on as you can get it. (This makes your defences very difficult to secretly weaken by malware).

Press the windows key and search. Windows Security and open:[2] “windows security”.Go to Virus & threat protection > Manage settings and ensure Real-time protection is on (unless a trusted third-party AV has taken over).

In Virus & threat protection settings, ensure Tamper Protection is on.

Go to Firewall & network protection and ensure the active network shows that Firewall is on.

How to verify: Windows Security Home should show you nothing urgent; and Tamper Protection should show on.

Common mistake: Quickly disabling Defender “temporarily” to set things up and forgetting to turn it back on.

4) Configure Windows Hello and require sign-in after sleep

A Windows Hello PIN is tied to your device (and is safer generally than recycling any account password everywhere); if your hardware allows, you might as well add an option for fingerprint or face sign-in, and then make sure the PC requires sign-in when it wakes (especially for laptops!)

Go to Settings > Accounts > Sign-in options.

Set up a PIN (Windows Hello); then add Fingerprint recognition or Facial recognition if relevant.

Change the “If you’ve been away, when should Windows require you to sign in again?” to a secure option (to many folks it may be worth doing that “when PC wakes up from sleep”).

How to verify: Put the PC to sleep or hibernate, and wake it: it should demand your PIN/biometrics to sign in—not just a pop-in at the desktop.

Common mistake: Using your birthday as a super-easy ‘PC PIN’ because of course it’s a super-easy PC PIN. Treat it willy-nilly, and bad things will happen.

5) Turn on Find my device (especially for laptops)

If you travel a lot with your PC, Find my device can be a wonderful way to get it back and/or lock it remotely. It usually requires signing into a Microsoft account and having location enabled at the device level.

Open Settings > Privacy & security > Find my device. Turn Find my device On.

OPTIONAL, BUT SMART: While you’re here, take a look at Settings > Privacy & security > Location to ensure device level location isn’t fully Disabled (Find my device depends on location).

How to verify it: Sign in to the Microsoft account devices page (from some other machine) and check that your PC shows up on that page with Find My Device options.

Common mistake: You’ve flipped on Find my device, but leave your PC offline most of the time; Find my device requires location (for the track) and an internet connection. (for the Find).

6) Review Smart App Control (new installs benefit most)

Smart App Control uses cloud intelligence to try to block apps that are suspicious or potentially unwanted. On many systems, Smart App Control begins in Evaluation mode to learn whether it’s a good fit for your system. On most home systems, especially on a clean Windows 11 install, leaving it in Evaluation mode (or enabling it) would give you a very touch-free, set-and-forget baseline.

Open Windows Security > App & browser control. Scroll to Smart App Control settings. Select Evaluation (Safe starting point) or On (stricter). If you install a lot of niche/Unsigned tools, you may want to pick Evaluation first.

• How to verify: Remember we chose the Smart App Control mode? Go back and see that it’s still chosen now that the PC’s been restarted.
• Common mistake: Off? MS had one installer blocked; I turned it off. Try the method they recommend instead of the broad off switch.

7) Turn on reputation-based protection (SmartScreen + PUA blocking)

Another “low-hanging fruit, high impact” win, SmartScreen and the new reputation-based settings, will warn you of suspicious downloads, phishing pages, and PUAs.

1. Open Windows Security > App & browser control
2. Open Reputation-based protection settings
3. Turn on the protection options you’re comfortable with, especially PUA blocking!

• How to verify: Just like the above, open up the Reputation-based protection settings and make sure the toggles are still On.
• Common mistake: Slapped both of these off to fix that one app I download and Windows blocked it. If you know you’ve got a clean file, investigate the source and signature instead of throwing off the threat tool altogether.

8) Enable ransomware protection

(Controlled folder access)

This is also (almost always) a lifesaver, allowing you to stop unknown apps (itty-bitties, whatever you like to call unwanted beasts) from changing anything packed away in Documents, folder, and other files on your desktop. It will however stymie good apps (sometimes beloved ones) in the process of figuring out that you really like that back up software you’ve been using since Windows XP. Again, counterintuitively, let’s get it on now before there’s stuff fighting for storage. If anything falls in here you trust, go through allow app before killing the tool altogether.

1. Open Windows Security > Virus & threat protection
2. Under Ransomware protection click Manage ransomware protection
3. Throw the mighty switch On for Controlled folder access
4. If something you trusted that you (correctly or incorrectly) allowed to access a folder gets blocked, make the allow-app choice rather than a general change.

9) Wright onedrive folder backup (its a setup choce not jsut as sync choce)

OneDrive offers to backup key folders like your Desktop, Documents, and/or Pictures, so they automatically land in the cloud for recovery if necessary and when moving to a new PC, but a number of people prefer to have stuff local-only, or to not use cloud storage at all, for privacy, bandwidth, and storage quota reasons, so decide now whether you do or not so that your file paths don’t surprise you later.

Open OneDrive settings (select the OneDrive cloud icon in your system tray if its running, and go to Backup > Manage backup), and tick/tock Desktop/Documents/Pictures backup On if you want it backing up seamlessly, Off if you want those folders to be local-only.

How to verify—in explorer, see where your Desktop/Documents point to actually (one drive or your local user profile).

Common mistake—ticking and later unticking to turn off backing up those folders and expecting it to “pull the files back over automatically” (you may have to move them manually).

10) Set Windows update Active hours (stop surprise restarts)

Active hours is a rough collection of things to help Windows take its restarts when its least likely to catch you working, and this is one of those settings you only notice when you weren’t diligent and need to be now.

1. Go to Settings > Windows update > Advanced options.
2. Find Active hours.
3. Choose Automatically if your schedule varies, or Manually and set your typical work hours.

11) Choose your update philosophy: “Get the latest updates as soon as they’re available”

Windows 11 usually has a toggle that says you’ll be first in line for the new fixes and features. Here’s where you differ from the newbie: there’s no right answer; it’s about your willingness to take some risk.

Want a stable PC (work machine, paper due for school)? Turn Off so that you’re not among the first when there’s a new change in a .0 release.

Want the new .1 update features now (enthusiast PC)? Turn on; be prepared for the occasional off-quirk when you get the next big update.

12) Know how to Pause updates and schedule restarts (without falling behind)

Pausing updates is handy if you’re in transit, gaming, (or compressively-not-derogatory), presenting, or involved in a major project. Just don’t get comfy doing it all the time!

1. Open Settings > Windows Update.
2. Pause updates, but only when you must (use for a minimum time necessary).
3. If Windows needs to restart to complete an update, tell it to Schedule the restart; don’t let it reboot the system at the least desired moment!

13) Tame Delivery Optimizations (especially upload sharing)

Delivery Optimization can actually accelerate downloading updates by uploading them between PCs—but it can also upload data to other devices and gobble up bandwidth you could use for something else. The compromise for many homes is “local network only” plus upload limits.

1. Go to: Settings > Windows Update > Advanced options > Delivery Optimization
2. Decide whether you want it doing downloads from other PCs (Off or local network only)
3. Set bandwidth limits and a monthly upload cap, to avoid updates hogging the line during video calls, streaming, or gaming.

14) Set metered connections for hotspots and capped plans

If you ever tether your phone to your device, or use an internet connection with a data cap, set your computer to metered mode so Windows and other apps don’t download large updates without your knowledge.

1. Go to: Settings > Network & internet
2. For Wi‑Fi: open Wi-Fi > open the network you’re connected to > and switch on Metered connection
3. If you’re on Ethernet, switch on Metered connection. (This is particularly useful on some mobile routers).

15) Reduce diagnostic data and review “Diagnostics & feedback” options

Windows collects as little required diagnostic data as it is required to. (Sometimes it also collects diagnostic data you don’t require to). Here, we want to choose the least we personally want, and disable linking the personalisation features we don’t want, to diagnostic data.

1. Go to: Settings > Privacy & security > Diagnostics & feedback
2. If you see the choice of diagnostic data (Required vs Optional), select the minimum diagnostic data you want to optionally share (many people select that they only share Required).
3. Turn off “personalized” experiences/offers to remove tips/ads/recommendations that are powered by diagnostic data.
4. Optionally, use the built-in options to delete your device diagnostic data when that option is available.

16) Turn off personalized offers, and recommendation toggles

There are lots of ways of wording this in different versions of Windows. But it should all have the same effect, peeling back those “helpful suggestions”, and promotional content that are powered by

1. Check Settings > Privacy & security > Diagnostics & feedback for any offers/personalization toggles.
2. Check for Settings > Privacy & security > Recommendations & offers (if the build you have has it), and toggle off anything you don’t want (turn everything off you don’t want especially if ads, offers, or personalization features etc. are mentioned).

17) Turn off Advertising ID

Some apps use the Advertising ID to show personalized ads based on the information they gather. If it’s off it won’t stop the ads, but at least it reduces the ad personalization at OS level.

1. Open Settings > Privacy & security > General (or Recommendations & offers on some builds).
2. Flick off Advertising ID / personalized ads toggle.

18) Turn off Activity history (and clear it)

Activity history remembers uses of apps you open, documents you access, websites you browse, and other activities. If you have no use for this functionality then turn it off and erase any existing history.

1. Open Settings > Privacy & security > Activity history.
2. Turn off storing activity history on the device (wording may vary).
3. Click Clear history to wipe out any existing stored history.

19) Tighten Location services (don’t just turn it off)

Location services are useful for maps (and directions), weather, some Wi fi features, automatic time zone if travelling, and Find my device. The best approach for many will be not “all on” or “all off”, but “on, then tightly restrict which apps can access it”.

1. Open Settings > Privacy & security > Location.

Consider whether you use location services. If you use Find my device, leave these settings On (especially for laptops), if not, turn access off.

3. If On, scroll and turn off access for any apps that don’t need access to location services.

20) Disable camera access (either globally or on a per-app basis)

If you never video call on this PC, there’s a global camera-off setting which is simple and works well. No more random camera pop-ups with you still wearing your pajama bottoms.

Otherwise, keep the camera on but only allow access to the apps you actually use, like Teams/Zoom, etc.

1. Open Settings > Privacy & security > Camera
2. Overall camera access off, or just keep it on, but turn access off for apps that don’t need access to the camera (most of them, we’re looking at you as app useful for video conference but also gives access to camera).

21) Disable microphone access (either globally or on a per-app basis)

Even more so than camera permissions, it’s surprisingly easy to grant too many apps access to the microphone. If you use no voice features, turn that permissions off globally. If you use it, grant access to just the apps you want/need to be able to use it for calls/recording.

1. Open Settings > Privacy & security > Microphone.
2. Turn microphone access overall off (if you don’t use it) or only allow access to apps you want to use your microphone.

22) Clean up notifications, lock-screen privacy, and Do not disturb rules

Device notifications, especially default ones, are too noisy, and lock screen notifications can expose private information (like a preview of your messages) right when you really need it to not. What you want here: Fewer apps allowed to buzz/honk/jerk you awake, and safer lock screen exposure.

1. Open Settings and type in Notifications to filter down.
2. Turn off notifications for apps you don’t want bothering you.
3. Adjust lock-screen notification behavior, if needed to be hidden behind lock (especially sensitive things like emails and/or messages).

Turn on do not disturb automatically and set rules (meetings, gaming, full-screen apps, specific hours).

📝 Practical rule: Keep notifications on for security (Windows Security), identity (password manager), and time-critical comms. Everything else can go away until you miss it.

Adjust Search permissions (cloud content, history, and personalization).

Windows search accesses your Microsoft account and can pull in information from there; some people love that, some people hate that, and some people would love it more if it were easier to configure to fit their habits, rather than Windows’ habits. Whatever camp you fall into, choose your route intelligently.

Go to Settings > Privacy & security > Search permissions and pick what you want.Want to be local only? Turn off cloud content search options (where you can).

Clear your search history, starting from scratch.

Set default apps now (browser, pdf, email).

Otherwise Windows is going to keep prompting you or picking emulated bricks to default apps these are heavy use apps and it makes sense to choose your own.

Go to Settings > Apps > Default apps to get started.

What else do you want to choose (try a few out and stick with what you love)? Pick your browser (make sure that the common types of web links tend to open correctly, others often get linked to wrongly… try a few to see what works best).

Search for .pdf and select what you want as your default PDF viewer.

Use a desktop mail client? Make sure that your mailto links open it’s always cool when Windows knows what you want to open when you click.

Reduce Start menu suggestions and recommendations.

Suggestions on the Start menu recommendations on the Start menu that talk about Windows Store apps, you can floor it the way you want, you likely don’t need to see it if you do not use it. If you want a more focused, less noisy Start menu, turn this off. (If you want to make this of colon, come back when you may want it).

Go to Settings > Personalization > Start and Toggle off what you do not use.

1. Turn off toggles related to suggestions, tips, or recommendations (names vary by build).
2. Re-pin only the apps you actually use weekly.

26) Simplify the taskbar (remove distractions you don’t use)

Your taskbar being excessively cluttered is an attention tax you pay every minute, even if you’re not actively using something. If you never touch Widgets or extra buttons, hide them, and you’ll save yourself some irritation every time you glance down.

1. Open Settings, then hit Personalization, and select Taskbar.
2. Under taskbar items, hide anything you never click on, like Widgets and extra search experiences. “Task View” is another big talking point no one asked for that might be a good idea to hide too.
3. If there are bad behaviors your taskbar does that you find annoying, like flashing or buggy things like badges to grab your attention at when you’re trying to do your work, go through taskbar behaviors and turn off anything that catches your eye, even for that one-in-one-hundred time it yells for you. You’ll be happier for it.

27) Show file extensions (and maybe show hidden items)

Showing file extensions will make life clearer, so you don’t get fooled by an “invoice.pdf.exe” kind of thing. You’ll also see exactly what kind of file it is before you even open it.

1. In File Explorer, click View, then Show > File name extensions.
2. If you’re someone that regularly has to troubleshoot or handle the data a program/want to tweak things by hand in landscape, you can leave Hidden items enabled, but if not, it’s best to leave it off so you’re not hitting your wall with a hammer too often or removing vital parts of it that you wish you had.

28) Disable apps running at startup by default (accelerate boot, lower CPU/RAM use)

Most applications add themselves to this “we need this feature, do it for us even though we’re fine on our own” list, helping no one except for themselves if we’re being honest. Keeping that in mind, it’s typically a good idea to disable anything you won’t be using on the regular, so you save frantically looking at a separate desktop and clean up CPU and RAM for real work.

1. Head to Settings > Apps > Startup.
2. Turn Off anything that you don’t want launching automatically. Game launchers are usually the worst offenders, but usually a handful of automatic chat apps get tagged too (you know their names too, they’re basically family barnacles on your RAM that you’d feel bad removing).

Leave On security-critical tools you rely on (password manager, security suite, backup tools).

29) Turn on Storage Sense (automatic cleanup without drama)

Storage Sense can automatically delete temporary files and clear out the Recycle Bin on a schedule. The key is to configure it so it doesn’t surprise you (especially if you keep installers or work files in Downloads).

1. Go to Settings > System > Storage.
2. Turn Storage Sense On.
3. Open Storage Sense settings and review cleanup rules (Recycle Bin timing, Downloads cleanup, and any cloud-related settings if shown).
4. Run a manual cleanup once to see what it would remove, before relying on it long term.

30) Set power mode and screen/sleep timers (battery + longevity + convenience)

Power settings affect battery life, fan noise, heat, and how often you lose your place due to sleep. A simple approach: use Balanced mode for everyday work, and only switch to Best performance when you actually need it.

1. Go to Settings > System > Power & battery.
2. Set Power mode (often: Balanced).
3. Go to Screen and sleep and set realistic timers (shorter on battery, longer on plugged-in desktops).

If you turned on Windows Hello earlier, check that wake-from-sleep still requires you to sign in (security + privacy)

Quick verification checklist (you can stop worrying now)

• Restart once. Then re-confirm: Device encryption/BitLocker status, Smart App Control mode, and notification rules.
• Open Windows Security: no urgent actions, firewall on, tamper protection on.
• Put your PC to Sleep and wake it: confirm it requires your PIN/biometric.
• Open Windows Update: confirm Active hours are set, and that you understand whether you’re paused or not.
• Open File Explorer: confirm you can see file extensions.
• Open Storage Sense: Run it once manually, just to confirm it doesn’t seem about to delete something you care about.

FAQ