Securing Your Windows Network: A Practical Checklist

Network security advice online tends toward two extremes: vague ("use strong passwords!") or overwhelming (a 40-page enterprise framework). This is neither — it's the ordered list of concrete steps that actually moves the needle on a typical Windows home or small-office network, roughly in the order they matter most.

1. Know what's on your network

You can't secure what you don't know exists. Before anything else, get a full, current list of every device connected to your network — PCs, phones, printers, smart-home gadgets, IoT sensors, guest devices. A network scanner does this in under a minute and gives you far more detail than your router's own client list (MAC vendor, open ports, inferred device type). We cover this in depth in our guide to finding unknown devices.

Label everything you recognize. An unlabeled, unexplained device is invisible in a long list — a labeled network makes anything new jump out immediately on the next scan.

2. Secure the router itself

• Change the default admin password. Default router credentials are public knowledge and the first thing scanned for.
• Update the router firmware. Most routers check for updates in their admin panel; some auto-update — verify it's actually enabled.
• Disable remote administration unless you specifically need it — it exposes your router's admin panel to the internet.
• Disable UPnP if you don't rely on it for gaming or specific apps — it lets any device on your LAN open port forwards without asking.

3. Lock down Wi-Fi

• Use WPA3, or WPA2 at minimum. Never WEP, never an open network — both are trivially breakable.
• Use a genuinely strong Wi-Fi password — long and random, not a dictionary word with a number appended.
• Set up a separate guest network for visitors and untrusted IoT devices, isolated from your main LAN, so a compromised smart plug can't reach your PC.
• Disable WPS — the PIN-based pairing feature has known weaknesses that can expose your Wi-Fi password.

4. Audit open ports and forwarding rules

Scan your network from the inside (LAN) and check what your router forwards to the outside (WAN) — these answer different questions and both matter. Close or firewall anything you don't actively use, and delete stale port-forwarding rules for services you no longer run. Our open ports guide covers exactly how, including the specific ports worth checking first.

5. Keep everything patched

• Enable automatic Windows updates on every PC — delayed patching is one of the single biggest contributors to real-world breaches.
• Don't forget non-Windows devices — router firmware, NAS software, camera firmware, printer firmware all ship security patches too, and are updated far less consistently by default.
• Prioritize by real risk, not just severity. See our guide to CVE, CVSS, EPSS and KEV for how to tell which vulnerabilities actually need urgent attention.

6. Review accounts and permissions

• Remove accounts you no longer use — a former employee's Windows login, an old shared admin account.
• Enable multi-factor authentication wherever it's offered, especially for anything with remote access.
• Avoid using an administrator account for daily work — a standard user account limits what malware can do if something does get through.

7. Back up before you need to

Ransomware remains one of the most common real-world outcomes of a network compromise, and a tested, offline (or immutable-cloud) backup is the single most reliable way to make that recoverable rather than catastrophic. A backup you've never restored from is not a verified backup — test it.

8. Set up ongoing monitoring

A checklist you run once is a snapshot; a network changes constantly. The highest-leverage habit is turning this from a one-time audit into something that watches continuously and tells you when something changes:

• Scheduled scans that re-check your device inventory, open ports and vulnerabilities automatically.
• Change alerts the moment a new device joins, a new port opens, or a device disappears — delivered to email, Slack or Telegram rather than requiring you to remember to check.
• Historical records so you can answer "when did this start" instead of only "what does it look like right now."

LANsentry's background Windows service runs exactly this kind of continuous monitoring — scanning on a schedule even while the app itself is closed, and surfacing results the moment you reopen it.