What is Microsoft Defender Antivirus?
Microsoft Defender Antivirus, formerly called Windows Defender, ships with every edition of Windows 10 and Windows 11 and is on by default. It protects against viruses, ransomware, spyware, rootkits and other malware using signatures, behavior monitoring and cloud-delivered protection. Users manage it in the Windows Security app under Virus & threat protection. The same app also holds Firewall & network protection, App & browser control (SmartScreen) and device security settings.
Key settings
- Real-time protection: scans files as they are opened, downloaded or run. Turning it off is temporary; Windows switches it back on automatically after a short time.
- Cloud-delivered protection and automatic sample submission: send data about suspicious files to Microsoft for faster verdicts on new threats.
- Tamper protection: stops malware and scripts from changing Defender's security settings. It can be turned off in the Windows Security app or by the organization's management tools.
- Controlled folder access: ransomware protection that blocks untrusted apps from changing files in protected folders such as Documents and Pictures.
- Exclusions: files, folders, file types or processes Defender skips. Malware sometimes adds exclusions for itself, so unexpected entries are a red flag.
Scan types
| Scan | What it does |
|---|---|
| Quick scan | Checks the places malware most often hides, such as startup locations and system folders |
| Full scan | Checks all files and running programs; can take an hour or more |
| Custom scan | Checks only the drives or folders you choose, such as a USB drive |
| Microsoft Defender Antivirus (offline scan) | Restarts the PC and scans before Windows loads, to catch rootkits and malware that hide while Windows runs |
Detected items are quarantined and listed in Protection history, where they can be removed or, for false positives, restored.
Updates
Defender's security intelligence (definition) updates are delivered frequently through Windows Update, and a manual check is in Virus & threat protection > Protection updates > Check for updates. The scanning engine and platform update the same way. Out-of-date definitions are one of the first things to check when malware gets through.
Command-line control
- PowerShell:
Get-MpComputerStatusshows whether protection is on and how old the definitions are,Update-MpSignatureupdates definitions,Start-MpScan -ScanType QuickScan(orFullScan) runs a scan, andStart-MpWDOScanstarts an offline scan. - MpCmdRun.exe in
%ProgramFiles%\Windows Defender: for example,MpCmdRun.exe -SignatureUpdate, orMpCmdRun.exe -Scan -ScanType 2for a full scan.
Third-party antivirus and Defender
Windows expects one primary real-time antivirus. When another antivirus product registers with Windows Security, Defender turns off its own real-time protection and Windows Security lists the other product as the active provider. If that product is uninstalled, Defender turns back on. An optional Periodic scanning setting lets Defender run occasional scans alongside the other product. Running two real-time scanners at once causes slowdowns and conflicts, which is why this hand-off exists.
Troubleshooting cues
- Real-time protection keeps turning off, tamper protection is disabled, or strange exclusions appear: suspect malware, follow the malware-removal procedure and run an offline scan.
- Windows Security says another app provides protection: a third-party antivirus is active, which is normal.
- Settings grayed out with a note about your organization: Group Policy or MDM manages Defender on that PC.
- Definitions will not update: check Windows Update and internet access, then try
Update-MpSignature.
Microsoft Defender Antivirus on the CompTIA A+ exam
Defender maps to Core 2 (220-1202) objective 2.2, which covers built-in Windows security settings, and objective 2.4, which covers detecting, removing and preventing malware. Know how to confirm it is on, update definitions, run quick, full and offline scans, and why it turns itself off when another antivirus is installed. Do not confuse it with Microsoft Defender for Office 365, an email security service, or Microsoft Defender for Endpoint, the business endpoint detection and response (EDR) product.