Microsoft offers some key advice for foiling ransomware attacks in Windows 11

Microsoft has asked users to enable Microsoft Defender for Endpoint’s Tamper Protection feature to protect themselves against ransomware campaigns, as it released the final version of its security configuration baseline settings for Windows 11. 

Microsoft helps businesses swim through the ocean of security-related settings and tweakable parameters by providing guidance in the form of security baselines.

As part of its guidance for Windows 11, the software giant asked its users to enable the Tamper Protection feature to prevent threat actors from overriding the security features of the installation.

“While you are enabling the Microsoft Security Baseline for Windows 11 (and/or Windows 10, and/or Windows Server 2022/2019/2016), make sure to enable Microsoft Defender for Endpoint’s “Tamper Protection” to add a layer of protection against Human Operated Ransomware,” noted Microsoft security consultant Rick Munck.

Munck pointed users to the Microsoft Security Compliance Toolkit 1.0, which allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines, while comparing them against other security configurations.

As part of the release, Microsoft is suggesting users to enable Defender’s Tamper Protection functionality.

“Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring,” explains Microsoft.

Tamper protection works by ensuring Defender’s secure, default values are locked, and can’t be modified through the Registry Editor, PowerShell cmdlets, or via Group Policy, which are usually exploited by malware to disable the security protections.