Settings>Update & Security>Windows Security>Virus & Threat Protection

Once you are on the “Virus & Threat Protection” page, ensure that the following settings are on: Real-time Protection Cloud-delivered Protection Tamper Protection Once that is done, go to “Controlled Folder Access” and turn the setting on. Next, go to the “Exclusions” tab and make sure the “.exe” file extension isn't listed, as it can be used to change things on your server. And finally, go to the notifications settings and do the same as is in the picture:

After that back out and check for any security updates in the main page of Virus and threat protection:

Settings>Update & Security>Windows Security>Firewall & Network Protection

Not much to say here, just make sure it looks like this, and if it doesn’t, turn on the firewall.

Settings>Update & Security>Windows Security>App & Browser Control

Inside the “Reputation-based Protection” settings and turn the following settings on:

Settings>Update & Security>Windows Security>Device Security

Go to where it says “Core Isolation” in the device security settings and make sure to turn it on before you restart check for any windows updates so you can get it all done in one big restart