Best Practices for Updating Windows 10

All About the Security Tools in the Windows 10 April 2018 Update

Our journey through the new features in Windows 10 Version 1803, which was released this past April, is nearly complete. Over the course of this series of articles, we have been working to make you aware of the enhancements that were added for the fifth feature update to Windows 10.

As a reminder, we’ve looked at the following elements already: Accessibility, Cortana,  Continue on PC, Storage Sense, Focus Assist and the Microsoft Store.

This week we are taking a closer look at the security improvements that were made as part of this release.

I am going to focus on the consumer-related security changes that were made.

Windows Hello

In past versions of Windows 10, you had to go into Windows Settings > Accounts > Sign-in options to setup Windows Hello’s fingerprint and facial recognition for your compatible device. In the Windows 10 April 2018 Update, you will now see prompts on the Lock Screen to set these items up on your device.

This allows greater discoverability of the biometric security options without having to dig into the Windows Settings app itself.

Local Account

Local Account Security Questions – Windows 10 April 2018 Update

There are still a lot of users who choose not to use a Microsoft Account to log into Windows 10. Although that can hamper some of the features in the operating system, it is a personal choice ultimately and understandable in some use situations.

That means using a local account to log into the system. In the past that also meant not having any recovery options directly on the device to recover a locked-out account. In the Windows 10 April 2018 Update a set of security questions are now available that enable a user to easily recover that locked-out local account and all its related documents and apps.

Just go into Windows Settings > Accounts > Sign-in options and select Update your security questions to begin the process. You will have to provide your local account’s password to fill out these questions so be sure to do this shortly after setting up the local account.

Windows Defender

Windows Defender Security Center – Windows 10 April 2018 Update

The Windows Defender settings has been renamed to Windows Defender Security Center in this update with a couple of new areas that are monitored.

Account Protection – Provides info about the Microsoft Account you are using on your device plus alerts you if you have a Windows Hello compatible device and encourages you to use facial/fingerprint recognition for additional security on your system. Also links to Dynamic Lock that can lock your device as you walk away with a paired Bluetooth device.

Device Security – Monitors compatible systems that have built-in hardware-level security using the systems Trusted Platform Module (TPM). This enables the storage of cryptographic keys, device authentication, boot code integrity and BitLocker drive encryption. If you are not using the capabilities of the systems TPM you will see an alert here with a link to learn more and set that feature up for use.

In the Windows 10 April 2018 update, Microsoft has renamed Controlled Folder Access to Ransomware Protection in the Security Center. You can set up local folders that are to be protected from unauthorized changes by ransomware plus you can access OneDrive’s new ransomware data recovery options from this same settings page. In that scenario, OneDrive Maintains iterations of your files for the past 30 days so that if you were infected with a virus or ransomware, you can go back and recover files before that attack occurred.

Microsoft Edge

Windows Defender Application Guard in Microsoft Edge – Windows 10 April 2018 Update

Previously this was a feature only available for Windows 10 Enterprise users. Now those of you on Windows 10 Pro can now turn on Windows Defender Application Guard (WDAG) on your compatible systems.

This is not installed by default, so it needs to be added under the Turn Windows features on and off applet in the legacy Control Panel.

Note: Your system must support virtualization to use WDAG.

When you select WDAG from the Microsoft Edge ellipsis menu, it will open a sandboxed version of Edge in a virtual machine of its own. This work area will be blocked off from the remainder of the OS. This feature comes in handy for those of you who may need to browse questionable sites as part of your job or for research purposes. Once you are done using this instance of WDAG just close the window and the virtual machine and all related data from that session will be securely deleted from your device.

The Windows 10 April 2018 Update for Microsoft Edge also added support for extensions when browsing using an InPrivate tab plus passwords can now be auto-filled when browsing using InPrivate tabs.

Privacy

Documents, Pictures and Video Privacy Settings – Windows 10 April 2018 Update

Although not directly security related, privacy does have some security implications, so I wanted to mention three new key privacy settings in the April 2018 Update.

In the Windows Settings > Privacy settings you can now control the specific apps that have permission to access key directories on your device. Documents, Pictures and Videos are all file folders that can contain key personal data, so this new option allows you to lock those folders down completely. You can also designate which apps can access them or use the default settings that are set as you open an app that requires access to those folders.

These key privacy questions about Documents, Pictures and Videos will also be asked during the out of box experience when setting up a new device or resetting a Windows 10 system.

—–

Next week we will look at the updates in Microsoft Edge, and that will conclude this series on the Windows 10 April 2018 update.

Best Practices for Updating Windows 10

Keeping Windows 10 updated can be a never-ending chore. How can you simplify the process?

Microsoft uses updates to improve Windows, fix bugs, and plug security holes. So keeping Windows up to date is key to ensuring the security and reliability of your operating system. But Microsoft doesn’t necessarily make it easy:  Updates can be intrusive, confusing, and problematic. You want to ensure that the updates don’t bother you when you’re working, that you’re getting all the right updates, and that the updates themselves don’t create trouble.

One trick is to know how to tweak the settings for Updates. You can schedule Active Hours to prevent Windows 10 from rebooting your PC after an update. You can view a history of updates to make sure you’re getting the right ones. And you can uninstall an update that’s not working properly. You can even tap into advanced settings to determine which updates you receive and when you receive them. Let’s check out some best practices for updating Windows 10.

Previous versions of Windows offer the Windows Update Control Panel applet for you to view and manage your updates. But Windows 10 has since jettisoned the Control Panel tool in favor of the Update & Security option in the Settings app. Open Settings and click on the category for Update & Security. Make sure the Windows Update screen is the active one.

Check for Updates. The first thing you might want to do is click on the button to Check for updates to see if any are waiting to be installed. If so, let the updates do their thing to ensure that you’re running the latest ones for Windows.

Schedule Restart. After Windows has been updated, you’re asked if you want to either restart now or schedule a restart. If you’re in the middle of something important, you don’t want to have to reboot. Instead, click on the link to Schedule the restart. Turn on the switch to Schedule a time and then select the time and date to restart your PC for the updates to take effect.

Change Active Hours. Next, you can tell Windows when you typically use your computer so you won’t be interrupted by a reboot after an update. At the Windows Update screen, click on the link to Change active hours. You can now set the hours during which Windows won’t automatically restart following an update. Click Save.

View update history. You can see which updates have been installed to make sure you have the right ones and to check for specific updates. Click on the link to View update history. Windows displays a list of all recent updates. To learn more about a specific update, click on its link. A Microsoft support page pops up to fill you in on the details of the update as well as any known issues.

Uninstall an update. Yes, Microsoft sometimes fouls up an update. We’ve all bumped into updates that did more harm than good. Usually, Microsoft will roll out another update to fix the previous problematic update. If not, uninstalling an update may be the only way to correct the glitch. To do this, click on the link to Uninstall updates. Windows takes you to the Control Panel applet for Installed updates. Double-click on the troublesome update to remove it.

Recover Windows. Occasionally an update really screws the pooch. In that case, you may have to recover or restore your Windows environment to a state that existed before the update. Return to the Windows Update screen and click on the link to View update history. From there, you can click on the link for Recovery options and then opt to reset your PC.

Keep in mind that resetting your PC removes your installed applications and customized settings.

Before you try resetting your PC, give system restore a chance instead. To get there, open Control Panel and open the System icon. Click on Advanced system settings. At the System Properties window, click on the tab for System Protection and click on the button for System Restore. Click Next at the first screen. At the screen that shows the last restore point, check the box to Show more restore points.

You may find a restore point for the problematic Windows update. Select the restore point you want to use. Click the button to Scan for affected programs to see what effect going back in time to this point might have on your applications. If you want to take the plunge, click Next to move on to restore your PC to this point.

Configure advanced options. Finally, return to the Windows Update screen under Settings. Click on the link for Advanced options. Here, you can tweak a variety of settings.

• “Give me updates for other Microsoft products when I update Windows” ensures that Microsoft Office and other installed Microsoft products are updated when you update Windows. Keep this on.
• “Automatically download updates, even over metered data connections (charges may apply)” could download updates over a cellular connection. If you’re concerned about eating into your data allowance, keep this off.
• “We’ll show a reminder when we’re going to restart” displays notifications about updates beyond just the standard reminder. If you don’t always pay attention to the reminder, you may want to turn this on; otherwise, keep it off.
• “Pause Updates” puts a halt to updates for a certain number of days. Since you want the latest updates installed on a regular basis, keep this setting off.

The settings to “Choose when updates are installed” apply more to organizations than to individuals. So you can leave these as they are.

Click on the link for Delivery Optimization. Here, you can allow updates to be downloaded from other PCs on your network rather than just straight from the Internet. If you enable this option, I recommend limiting it to “PCs on my local network.” You can also check out the Advanced options on this screen, but I would leave the default settings alone.