SMB compliance
Windows 11 Pro Hardening Checklist & Security Baseline (2026)
Actionable hardening steps for Windows 11 workstations, covering hardware-enforced isolation, BitLocker, PowerShell execution policies, and local group policies.
Data reviewed October 24, 2026
Windows 11 includes advanced hardware-based security capabilities, including TPM 2.0 requirements, Secure Boot, and Virtualization-Based Security (VBS). However, default configurations prioritize consumer convenience over defensive isolation. This baseline guide configures Windows 11 for enterprise and small business resilience.
| Security Control | Default Setting | Recommended Hardened Setting |
|---|---|---|
| BitLocker Encryption | Disabled / 128-bit | Enabled (XTS-AES 256-bit + Startup PIN) |
| Memory Integrity (HVCI) | Varies by OEM | Enabled (Enforces VBS kernel protection) |
| UAC Prompt Behavior | Prompt for non-admins | Always Notify on Secure Desktop |
| PowerShell Execution Policy | Restricted / Undefined | RemoteSigned or AllSigned with Constrained Language |
Hardware-Enforced Isolation & Memory Integrity
Enable Virtualization-Based Security (VBS) and Memory Integrity (Hypervisor-Protected Code Integrity / HVCI) in Windows Security under Core Isolation to prevent malicious kernel injection.
BitLocker Full Disk Encryption with Startup PIN
Enable BitLocker on the operating system drive with AES-XTS 256-bit encryption. Configure a pre-boot TPM startup PIN via Local Group Policy to defend against cold-boot DMA attacks.
Attack Surface Reduction (ASR) Rules
Deploy Microsoft Defender Attack Surface Reduction rules via PowerShell to block Office applications from creating child processes and prevent credential stealing from the LSASS process.
Frequently asked questions
- Does enabling BitLocker slow down SSD performance?
- Modern processors feature hardware-accelerated AES-NI instruction sets, resulting in an imperceptible 1% to 3% drive performance impact.
- What is Memory Integrity in Windows 11?
- It is a feature of Virtualization-Based Security (VBS) that isolates kernel-mode code execution inside a secure virtual container to prevent rootkits.