Two PCs with the same antivirus can behave completely differently in a ransomware test. The difference is usually four toggles. Here they are, in the order to check them.
People often ask which antivirus won a ransomware test. The more useful question is which settings the PC had. Microsoft Defender ships strong, but PCs in the real world get tweaked - a debloat script here, a helpful forum tip there - and four specific settings quietly end up off. Those four decide whether Defender sees a brand-new threat in time, and whether anything can switch Defender itself off before the attack starts. Open Windows Security > Virus & threat protection > Virus & threat protection settings > Manage settings and walk this list.
Real-time protection is Defender actually watching files as they are opened, copied and run. With it off, Defender becomes a manual scanner that only helps when someone remembers to run it. It should be On, permanently. If you ever paused it for a specific task, set a same-day reminder to turn it back on - "temporarily off" is how many infections begin.
A signature database on your PC can only contain threats someone has already catalogued. Cloud-delivered protection lets Defender ask Microsoft's live intelligence about a suspicious file at the moment it appears, using behavioural and machine-learning analysis that is updated continuously. For ransomware - where the exact file may be hours old - this is frequently the difference between "unknown file, allowed" and "blocked on sight". Keep it On.
When Defender meets a file it cannot judge locally, sample submission can send that file (or details about it) to Microsoft for deeper analysis and a fast verdict. Turning this off does not make you more private in any meaningful everyday sense - it mostly makes your PC slower to learn. Keep it On; in managed office environments it can be set centrally, which is covered in our Group Policy guide.
Attackers know Defender is the obstacle, so a common early move in an intrusion is trying to switch Defender off or add an exclusion for the malicious file. Tamper Protection exists to refuse exactly that: security settings cannot be changed by other programs, scripts or registry edits - only by you, in the Windows Security app, as an administrator. If you find Tamper Protection off on a PC where nobody remembers turning it off, treat that as a warning sign in itself and run a full scan, then an offline scan, before trusting the machine again.
None of this costs money or needs third-party tools. It is the factory defence, fully awake.
See the test setup and the defences in action on the Technical Anshu channel, then come back and apply the settings on your own PC.
Watch Full VideoThat is precisely what Tamper Protection is designed to prevent - settings cannot be changed by programs or scripts, only by a signed-in administrator in the Windows Security app. Keeping it on, and using a standard (non-admin) account for daily work, makes silent disabling far harder.
Running two real-time antiviruses usually causes conflicts and slowdowns rather than double safety. A well-configured Defender with cloud protection and Controlled Folder Access is the setup these guides build. Whatever you choose, keep exactly one real-time shield and keep it fully on.
Open Windows Security, go to Virus & threat protection, then Manage settings under Virus & threat protection settings. Real-time protection, cloud-delivered protection, automatic sample submission and Tamper Protection should all read On.