Lock Down Your Own Devices: Updates, MFA, Encryption and Backups (Tech+)

Why it matters. Locking your front door won’t stop a determined burglar, but it stops the ones walking down the street trying every handle. Most attacks on home devices are like that: automatic, cheap and aimed at whoever left something open. These habits close the open doors, and help desk staff walk people through them every day.

The checklist at a glance

Before you start: open PowerShell

You type the checks below into PowerShell, a window where you give the computer instructions by typing instead of clicking. Click Start (the Windows logo at the bottom of the screen), type powershell, and click Windows PowerShell. Don’t pick “Run as administrator”: every check here works as a normal user. Stuck? Here is how to open PowerShell, step by step. Each grey box has a copy button; paste with a right-click in PowerShell, then press Enter.

1. Updates and patching

Software has mistakes. When a company finds one that attackers could use, it ships a patchIn plain words: A small fix for a program, like a repair kit for one broken part.Technical: An update that changes code to fix a bug or a security vulnerability. Microsoft ships most Windows patches on the second Tuesday of each month (“Patch Tuesday”).. Once a fix is public, attackers study it too and go after everyone who hasn’t installed it yet. That is why “remind me later” is the riskiest button on your computer.

• Windows: Settings (Windows key + I) → Windows Update → Check for updates. Restart when it asks; many fixes only take effect after a restart.
• Mac: System Settings → General → Software Update, and turn on automatic updates.
• iPhone: Settings → General → Software Update. Android: Settings → System → Software update (the exact name varies by phone maker).
• Apps need updates too: browsers, PDF readers and games get patched just like Windows. More on that in step 9.

Check which Windows version you have and when the latest updates went in:

PS> Get-ComputerInfo -Property OsName, OsVersion, OsLastBootUpTime
PS> Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 3 HotFixID, Description, InstalledOn

OsName                   OsVersion  OsLastBootUpTime
------                   ---------  ----------------
Microsoft Windows 11 Pro 10.0.26300 10/26/2026 11:46:29 AM

HotFixID  Description     InstalledOn
--------  -----------     -----------
KB5121794 Update          10/14/2026 12:00:00 AM
KB5127648 Security Update 10/14/2026 12:00:00 AM
KB5127694 Update          10/14/2026 12:00:00 AM

Each KB number (Knowledge Base article) is one update Microsoft published. If the newest date is more than about six weeks old, go to Windows Update and check. A last boot time weeks ago can also mean updates are waiting for a restart.

2. Antivirus

MalwareIn plain words: Any program made to do something bad: steal passwords, spy on you, or lock your files and demand money.Technical: Short for malicious software. Viruses, worms, trojans, spyware and ransomware are all types of malware. is any program built to cause harm. Antivirus software (also called anti-malware) checks files as they arrive and as they run, and compares them with a list of known bad programs. That list is called the definitions or signatures, and it updates several times a day, so an antivirus with old definitions is a guard with an old wanted-poster wall.

Windows includes Microsoft Defender Antivirus for free. Open the Start menu, type Windows Security, open it, and choose Virus & threat protection. Green check marks mean you’re covered. On a Mac, Apple’s built-in protection (XProtect) runs in the background with no settings to change. On phones, the official app stores scan apps for you; Android also has Google Play Protect in the Play Store app under your profile picture.

Ask Windows which antivirus it thinks is protecting you:

PS> Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName
PS> Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

displayName
-----------
Windows Defender
Bitdefender Antivirus

AntivirusEnabled RealTimeProtectionEnabled AntivirusSignatureLastUpdated
---------------- ------------------------- -----------------------------
           False                     False

This result surprised us, and it’s a good lesson. Our test PC runs Bitdefender, a paid antivirus. When another antivirus takes over, Defender steps aside on purpose so the two don’t fight, which is why the second line says False. That’s normal. What isn’t normal is False with only Windows Defender in the first list: that means nothing is scanning, so open Windows Security and turn real-time protection back on. If Defender is your only antivirus, you’ll see True and a recent date instead.

Two antivirus programs is not double protection. It’s two bouncers arguing in the doorway while I walk past. Pick one. — Nyx

3. Firewall

Your computer talks to the network through numbered doors called ports. A firewallIn plain words: A doorman for network traffic. It lets in what you asked for and turns away strangers.Technical: Software or hardware that allows or blocks network traffic based on rules (address, port, program). Windows Defender Firewall is a host-based firewall; your home router has a network firewall too. decides which connections may come in. Replies to things you asked for (the web page you opened) are let in; strangers knocking on random ports are turned away.

Windows has three firewall profiles: Domain (a work network run by an IT team), Private (home) and Public (cafés, airports, hotels). Public is the strictest. All three should be on:

PS> Get-NetFirewallProfile | Select-Object Name, Enabled

Name    Enabled
----    -------
Domain     True
Private    True
Public     True

Any False? Open Windows Security → Firewall & network protection and turn it on for that profile. With a third-party security suite, its own firewall may take over and Windows will say so on that screen. On a Mac: System Settings → Network → Firewall, which is off by default on many Macs.

4. Multi-factor authentication

A password is one proof that you are you. Multi-factor authentication (MFA)In plain words: Signing in needs two different kinds of proof, so a stolen password alone is not enough.Technical: Authentication using two or more factor types: something you know (password, PIN), something you have (phone, security key) and something you are (fingerprint, face). Two-factor (2FA) is MFA with exactly two. asks for a second proof of a different kind. The three kinds are:

• Something you know: a password or PIN.
• Something you have: your phone, an authenticator app, a security key you plug in.
• Something you are: a fingerprint or your face.

A password plus a PIN is not MFA, because both are things you know. Turn MFA on first for your email (it can reset every other account), then banking, shopping and game accounts. Look in each account’s Security settings for “two-step verification” or “2FA.” From strongest to weakest: a passkey or security key, then an authenticator app code, then a text-message code. Any of them beats a password alone.

One rule matters more than the rest: never read an MFA code out to anyone who calls or messages you, even “your bank.” Real companies never ask for it.

5. A password manager

A password manager is an app that creates a long, random, different password for every site, stores them all behind one master password, and fills them in for you. You remember one; it remembers hundreds. It also refuses to autofill on a fake look-alike site, which makes it quietly good at spotting phishingIn plain words: A fake message or website that tricks you into typing your password or clicking something harmful.Technical: Social engineering over email, text or web pages that impersonates a trusted sender to steal credentials or deliver malware.Click for the full glossary entry.

Good free starting points are the one built into your phone or browser (Apple Passwords, Google Password Manager, Microsoft Edge), or a separate app such as Bitwarden. Make the master password a long passphrase, and turn on MFA for the password manager itself.

6. Disk encryption

EncryptionIn plain words: Scrambling information so it looks like nonsense to anyone without the key.Technical: Transforming data with an algorithm and a key so it can only be read by someone holding the right key. Full-disk encryption protects data at rest (stored on the drive). scrambles everything on the drive. Without it, a thief can pull the drive out of a stolen laptop, plug it into another computer and read every file, password or no password. With it, they get noise.

Why not a command? We tried the usual one as a normal user, and it needs an administrator:

PS> manage-bde -status C:

BitLocker Drive Encryption: Configuration Tool version 10.0.26100
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

ERROR: An attempt to access a required resource was denied.

Check that you have administrative rights on the computer.

That’s security working as designed: ordinary accounts can’t read or change encryption settings. Use the Settings paths in the table instead. When you turn encryption on, Windows gives you a recovery key, a long number that unlocks the drive if something goes wrong. Keep it somewhere other than the computer itself. If you sign in with a Microsoft account, it is usually saved at account.microsoft.com/devices/recoverykey.

7. Screen lock

The fastest “hack” is someone using your unlocked computer while you get a coffee. Two habits fix it:

• Lock it when you walk away. On Windows press Windows key + L. On a Mac press Control + Command + Q. On a phone, press the side button.
• Make it lock itself. Windows: Settings → Accounts → Sign-in options → “If you’ve been away, when should Windows require you to sign in again?” and choose When PC wakes up from sleep. Then set a short sleep time in Settings → System → Power & battery (just Power on some desktops). Mac: System Settings → Lock Screen. Phones: Auto-Lock (iPhone, under Display & Brightness) or Screen timeout (Android, under Display).

On a phone, a six-digit PIN or longer beats a pattern you can see in finger smudges. Face and fingerprint unlock are fine for everyday use.

8. Backups

A backup is a second copy kept somewhere else. It is the only thing that saves you from a dead drive, a stolen laptop or ransomware (malware that locks your files and demands payment). Follow the 3-2-1 rule from the data lesson: three copies, on two kinds of storage, one of them somewhere else.

• Windows: the Windows Backup app (search for it in Start) copies your folders, settings and apps to OneDrive. For an external drive, use File History: Control Panel → System and Security → File History.
• Mac: Time Machine with an external drive: System Settings → General → Time Machine.
• iPhone: Settings → your name → iCloud → iCloud Backup. Android: Settings → Google → Backup (some brands put it under System).

Unplug the external drive after each backup. Ransomware locks every drive it can reach, including a backup drive left plugged in.

Nova tests her backups by restoring one file every month. I test mine by losing everything and finding out. Hers is the better method. — Nyx

9. Keep your apps updated

Windows Update patches Windows, but most of the programs you installed yourself update separately. Windows includes winget (the Windows Package Manager), which can list every app that has a newer version. Listing changes nothing:

PS> winget upgrade

Name                 Id                            Version   Available  Source
------------------------------------------------------------------------------
7-Zip 25.01 (x64)    7zip.7zip                     25.01     26.05      winget
Git                  Git.Git                       2.54.0    2.56.0.4   winget
Wireshark 4.6.3 x64  WiresharkFoundation.Wireshark 4.6.3     4.6.9      winget
...
48 upgrades available.

We trimmed the list to three rows and narrowed the spacing so it fits on the page; your list will show your own apps. Our test PC had 48 apps out of date, which is very common. The first time you run winget it may ask you to accept the store’s terms: type Y and press Enter. To actually update an app you would run winget upgrade --id 7zip.7zip (or update it from inside the app). We didn’t run that part on our test PC, and Windows may ask for permission before installing. The install software safely lesson covers winget in more depth. Phones handle this in the app store: turn on automatic app updates in the App Store or Google Play settings.

10. Safe browsing and privacy settings

• The padlock isn’t a trust badge. The padlock (and https://) means the connection is encrypted, so nobody in between can read it. It does not mean the site is honest; scam sites have padlocks too. Read the actual address before you type a password.
• A web page that says you have a virus is the scam. Real antivirus doesn’t show alerts inside a web page with a phone number to call. Don’t call, don’t click; close the tab (or the whole browser).
• Fewer extensions. Browser add-ons can read the pages you visit. Keep only the ones you use, from the browser’s official store.
• Check app permissions. Windows: Settings → Privacy & security, then Location, Camera and Microphone. iPhone: Settings → Privacy & Security. Android: Settings → Security & privacy → Permission manager (names vary). A flashlight app has no reason to want your location.
• Turn off ad tracking if you don’t want it: Windows Privacy & security → General has a switch for “personalized ads” using an advertising ID.

Your 10-minute lockdown

• Windows Update — check, install, restart
• Windows Security — green check marks for virus protection and firewall
• MFA on email — then bank, shopping and games
• password manager — one long master passphrase, MFA on it too
• encryption on — recovery key saved somewhere other than the device
• Windows key + L — and a short auto-lock time
• a tested backup — 3 copies, 2 kinds of storage, 1 elsewhere
• winget upgrade — see which apps are out of date

Do the email MFA today. Everything else on this list can wait until the weekend; that one can’t. — Nova

Where this fits

This is part of the free CompTIA Tech+ roadmap: computer basics in the order the exam teaches them. These topics are in the Tech+ practice test, scored by exam domain.

NextTest yourself: the Tech+ practice test→

Go deeper

• Strong passwords and passphrases — for your master password
• Network security explained — what the firewall is defending against
• Read email headers and report phishing — where most stolen passwords start
• How to open Command Prompt and PowerShell — for the checks above

Explainer, written by StashGrid with AI help and checked against the CompTIA Tech+ (FC0-U71) exam objectives before publishing. Every PowerShell command shown was run on a Windows 11 Pro PC as a normal user (no administrator rights) on Nov 4, 2026, and the outputs are from that PC. Not run: the Settings and app-store click paths for Mac, iPhone and Android (described from the makers’ current menus, which vary by version and brand), and actually installing an update with winget upgrade --id. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.