How to secure a personal computer for work with basic endpoint controls

TL;DR — If you use your own computer for work, the safest baseline is: turn on automatic updates, full-disk encryption (encrypts everything on the drive), the built-in firewall, the built-in antivirus, screen lock, and multi-factor authentication on your work account. The single most likely fix is that one of these is still off by default, especially disk encryption or automatic updates. Reading time: ~5 min

Goal

When you finish, your personal Windows or Mac computer will have current system updates, full-disk encryption enabled, the built-in firewall and antivirus running, a short automatic screen lock, and your work account protected with multi-factor authentication, so the device is safe enough for normal work use.

Prerequisites

• Your personal computer running one of these:
  • Windows 11
  • macOS 14 or later
• An administrator account on that computer
• Your work account login details
• Your phone available for multi-factor authentication (MFA, a second sign-in check)
• 30-60 minutes with the computer plugged into power
• Internet access
• Optional: a password manager app if you already use one

Steps

Step 1: Install all operating system updates

On Windows: Settings → Windows Update → Check for updates → Download & install all

On Mac: System Settings → General → Software Update → Update Now

If you see an option for automatic updates, turn on all available update toggles.

What you should see when this works: a message like You're up to date or Your Mac is up to date.

Step 2: Turn on full-disk encryption

⚠️ Encryption setup can take time, and some computers require you to save a recovery key (a code used if you forget your password or the device has a problem). Save that key in your password manager or another safe place before you continue.

On Windows 11:

• Go to Settings → Privacy & security → Device encryption
• Turn on Device encryption
• If you do not see Device encryption, go to Control Panel → System and Security → BitLocker Drive Encryption → Turn on BitLocker

On Mac:

• Go to System Settings → Privacy & Security → FileVault
• Click Turn On
• Choose Allow my iCloud account to unlock my disk or save the recovery key somewhere safe

What you should see when this works: Windows shows Device encryption is on or BitLocker shows the drive as On; Mac shows FileVault is turned on for the disk.

Step 3: Confirm the firewall is on

On Windows:

• Go to Control Panel → System and Security → Windows Defender Firewall
• Click Turn Windows Defender Firewall on or off
• Select Turn on Windows Defender Firewall for both Private network settings and Public network settings

On Mac:

• Go to System Settings → Network → Firewall
• Turn Firewall to On
• Click Options and leave Automatically allow built-in software to receive incoming connections turned on

What you should see when this works: the firewall status shows On.

Step 4: Confirm built-in antivirus is active

On Windows:

• Go to Windows Security → Virus & threat protection
• Under Virus & threat protection settings, click Manage settings
• Turn on these exact switches:
  • Real-time protection = On
  • Cloud-delivered protection = On
  • Automatic sample submission = On
  • Tamper Protection = On

On Mac:

• macOS includes built-in malware protections, but there is no single antivirus switch like Windows. Do this instead:
• Go to System Settings → Privacy & Security
• Confirm App Store and identified developers is selected under app security, if shown on your version
• Do not disable built-in security prompts when opening apps

What you should see when this works: Windows Security shows green checks; on Mac, apps from unknown sources are blocked unless you explicitly approve them.

Step 5: Set a short screen-lock timeout and require a password

On Windows:

• Go to Settings → Accounts → Sign-in options
• Set If you've been away, when should Windows require you to sign in again? to Every Time
• Then go to Settings → System → Power & battery → Screen and sleep
• Set these values:
  • On battery power, turn off my screen after = 5 minutes
  • When plugged in, turn off my screen after = 10 minutes
  • On battery power, put my device to sleep after = 10 minutes
  • When plugged in, put my device to sleep after = 15 minutes

On Mac:

• Go to System Settings → Lock Screen
• Set these values:
  • Start Screen Saver when inactive = 5 minutes
  • Turn display off on battery when inactive = 5 minutes
  • Turn display off on power adapter when inactive = 10 minutes
  • Require password after screen saver begins or display is turned off = Immediately

What you should see when this works: after a few idle minutes, the screen turns off or locks, and you must enter your password to continue.

Step 6: Use a standard account for daily work if possible

On Windows:

• Go to Settings → Accounts → Other users
• If you already have a second account, select it and check that it says Standard User
• If not, click Add account and create a separate everyday account
• Use your administrator account only when Windows asks for permission to install or change system settings

On Mac:

• Go to System Settings → Users & Groups
• Click Add User and create a user with Standard as the account type
• Use that account for normal work

What you should see when this works: your everyday account is labeled Standard instead of Administrator.

Step 7: Turn on multi-factor authentication for your work account

In your work identity provider's dashboard, look for a path similar to one of these:

• Account Settings → Security → Two-Factor Authentication → Turn On
• Profile → Security → Multi-Factor Authentication → Enroll

Choose one of these methods in this order:

1. Authenticator app
2. Security key
3. SMS text message only if the first two are not available

What you should see when this works: the security page shows MFA enabled, 2FA enabled, or a green status next to your second factor.

Step 8: Turn on device finding and remote wipe if your OS supports it

On Windows:

• Go to Settings → Privacy & security → Find my device
• Turn on Find my device

On Mac:

• Go to System Settings → [your name] → iCloud → Find My Mac
• Turn on Find My Mac

What you should see when this works: the setting shows On.

Verify it works

Check each item below on your computer:

Your end-to-end result is correct if all seven checks pass.

Common pitfalls

BitLocker or Device Encryption is missing on Windows

Mistake: looking only for Device encryption in Settings.

Symptom: you do not see the setting, so you assume encryption is impossible.

Fix: open Control Panel → System and Security → BitLocker Drive Encryption and turn on BitLocker there.

FileVault or BitLocker was turned on, but the recovery key was not saved

Mistake: clicking through encryption setup without storing the recovery key.

Symptom: later recovery prompts appear and you do not have the code.

Fix: stop and save the recovery key in your password manager or another secure location before you continue.

The computer keeps staying unlocked at your desk

Mistake: setting screen-off time but not the password requirement.

Symptom: the display sleeps, but moving the mouse returns to the desktop without a password.

Fix: set require sign-in = Every Time on Windows or Require password = Immediately on Mac.

MFA is enabled, but only by SMS when an authenticator app was available

Mistake: choosing the fastest option during setup.

Symptom: sign-ins work, but account recovery is weaker and text messages can fail when traveling.

Fix: go back to your work account security page and add an authenticator app as the primary method.

Updates are paused or waiting for a restart

Mistake: installing updates but skipping the reboot.

Symptom: the update page still shows pending items or asks to finish setup later.

Fix: click Restart now from the update screen and recheck until it says up to date.

You still use an administrator account for everything

Mistake: doing daily browsing, email, and downloads from the admin account.

Symptom: any bad installer or browser exploit gets full system-level access more easily.

Fix: create a Standard user account and use that for normal work.

---

This article was written by an AI system and published pending human review. Verify anything you intend to act on.