Advanced network security, including encryption and firewall protection, now includes support for Hyper-V Firewall, Wi-Fi6, WPA3, and an encrypted DNS protocol, and support for more Bluetooth connections including Secure Simple Pairing, Secure Connections, and Core Spec compliance up through version 5.3.

Kernel DMA protection is now enabled by default on new devices to shield your device against physical breach from peripheral devices such as infected USB drives.

Local security authentication is enabled by default on new, enterprise-joined devices to validate users for local and remote sign-ins and enforce local security policies.

Microsoft Defender SmartScreen proactively warns when you enter your credentials into a risky location.

Now available on a growing number of devices, Pluton provides additional protection for sensitive information like credentials, with feature and security updates directly provided through Windows Update. ⁵

The block list policy is now enabled by default to protect your Windows kernel against potentially vulnerable drivers, and users can enforce the policy from the Windows Security apps.

For more control and transparency, you can choose privacy settings and track app and resource usage through icons that appear in the system tray when an app is in use.

Designed to provide additional protection for sensitive data, new Secured-core PCs continue to be added to the market. ⁶

Virtualization-based security (VBS) and hypervisor code integrity (HVCI) are enabled by default, for silicon-assisted safeguards that protect your OS without slowing performance.

The server message block (SMB) protocol provides end-to-end encryption of SMB data and protects against eavesdropping on internal networks. SMB now increases networking security with Advanced Encryption Standard (AES)-256, SMB Compression, and by turning off default SMB guest authentication.

TPM 2.0 is required and enabled by default for confirmation that the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources.

Windows Hello enables personal, secure sign-in options including PIN, face, or fingerprint recognition and innovations like presence sensing, which locks your device when you step away, and signs you again when you return. ⁶

Windows can schedule updates when renewable energy sources are available. This carbon-aware feature activates when devices are plugged in, turned on, and connected to the internet with access to available regional carbon intensity data.

Sustainable power settings and recommendations enable Windows to reduce energy use by default when your device is idle.

Windows 11 updates use 40% less bandwidth for better network costs and efficiency, making it easier to keep devices anywhere up-to-date and protected.

Windows 11 Pro supports modern device management with tools like Microsoft Intune and Azure Active Directory. Built-in clients simplify device enrollment and policy management.