Windows 10 and Windows 11 security recommendations

The most important security recommendation for Windows 10 today is to move to Windows 11. Windows 10 stopped receiving free security updates on October 14, 2025, and companies can now protect it only through the paid Extended Security Updates (ESU) program, until October 2028 at the latest. The other recommendations below, from passwords to backup, apply to both versions.

The security of an IT infrastructure is only as strong as the most vulnerable system on the network. When we talk about security, we shouldn’t think only of the company’s servers: workstations are just as important.

Is Windows 10 still safe?

No, unless it receives ESU updates. When we wrote the first version of this article, in July 2021, Windows 10 ran on most workstations in companies. Since then, the situation has changed:

• since October 14, 2025, Windows 10 no longer receives free security updates, so the flaws discovered since then stay open;
• the ESU program for individual users ended on October 13, 2026;
• companies can buy ESU for each computer, until October 2028 at the latest, at a cost that rises every year;
• Microsoft still updates the Defender antivirus signatures on Windows 10, but antivirus can’t cover operating system flaws;
• compatible computers can move to Windows 11 for free.

For details about the free upgrade, see the article on the free Windows upgrade, and for the risks of systems that are out of support, the article on the problem of end-of-life (EOL) technologies.

Which security recommendations apply to Windows 10 and Windows 11?

Use a strong password or Windows Hello

Set a long password for your Windows account, for example a phrase of at least 15 characters that’s easy to remember, so you don’t need to write it on a note stuck to your desk or under your keyboard. Windows Hello is even more convenient: a PIN tied to the computer, your fingerprint or face recognition.

When you’re not using your computer, lock it with Windows + L and enter your password again when you come back. Don’t leave your computer unattended and unlocked with your account.

Disable remote access you don’t use

If you don’t need to access your computer remotely, make sure remote connection apps and Remote Desktop are disabled. The exception is the support app installed by the company’s IT team. If you do need remote access, use it only through a VPN, with two-step verification.

This lowers the risk of people with malicious intent sabotaging your work.

Keep your antivirus and firewall turned on

Never disable the firewall or the antivirus protection, because that leaves the workstation vulnerable. Microsoft Defender is included in Windows 10 and Windows 11.

For companies, RezolvIT recommends a security solution that can be managed from a cloud console, because it allows central management of licenses and alerts across all computers.

Install operating system updates

Install operating system updates as soon as they come out. Ideally, agree with technical support on a time when you can do without your workstation, or start the update at the end of the workday and let it run overnight.

On Windows 11, the annual version matters too: each version receives updates for 24 months in the Home and Pro editions and for 36 months in the Enterprise and Education editions, so the annual feature update shouldn’t be postponed indefinitely.

Turn on disk encryption

Disk encryption matters both for you and for the company. If your laptop is lost or stolen, the data on the encrypted disk can’t be read by people with malicious intent.

In the Pro, Enterprise and Education editions, use BitLocker; in the Home edition, use device encryption, on compatible computers. Keep the recovery key in a safe place, for example in the company account managed by the IT team.

Set up a solid backup policy

Set up a solid backup policy for all of the company’s workstations.

Backup is indispensable for companies: it protects you when one of the files you’re working on becomes corrupted, or in the worst-case scenario where your data is encrypted by ransomware.

Work with an account without administrator rights

Use a regular user account without administrator rights day to day. Most malicious programs need these rights to install themselves, and new programs are installed by the IT team.

Turn on two-step verification

Your Windows account is only one part of the picture. Turn on two-step verification for email, Microsoft 365, VPN and the company’s important applications too, so that a stolen password isn’t enough for an attacker.

What do you do with computers that can’t move to Windows 11?

Windows 11 requires, among other things, a compatible processor, TPM 2.0 and Secure Boot, and on new computers it turns on by default protections that were optional on Windows 10. For computers that don’t meet the requirements, you have three options:

1. Replace them on a schedule, starting with those that handle important data.
2. Buy ESU for those that need to keep running for a while, until October 2028 at the latest.
3. Take them off the company network, if they run only an old application, with no access to the internet or to company data.

What we don’t recommend: leaving Windows 10 computers that no longer receive updates on the network. For companies covered by NIS2 (transposed in Romania by GEO 155/2024), unsupported systems can also become a compliance problem, because the directive requires vulnerability management.

A free IT audit shows you which computers can move to Windows 11 and what needs replacing, and with IT maintenance, updates are installed and checked on every workstation.

RezolvIT is an IT outsourcing company experienced in implementing cloud technologies and helping companies let their employees work from home.