Microsoft Defender is Microsoft’s family of security products, and on a Windows PC the name refers first of all to Microsoft Defender Antivirus, the anti-malware engine built into Windows 10 and Windows 11 that scans files, processes and scripts in real time. In Windows security it is the default protection layer that every installation has out of the box, formerly known as Windows Defender.
The same brand also covers cloud-managed enterprise services such as Microsoft Defender for Endpoint, which adds endpoint detection and response, and Microsoft Defender XDR, which correlates signals across devices, email, identities and cloud apps. Understanding which part of the family is meant is essential when reading documentation or licensing terms.
How Microsoft Defender Antivirus protects Windows
Microsoft Defender Antivirus combines several detection layers that run as the Windows service WinDefend and the user-mode process MsMpEng.exe. Signature matching catches known threats, while behavior monitoring and machine learning models detect new or modified malware from what it does rather than what it looks like.
| Component | What it does | Default state |
|---|---|---|
| Real-time protection | Scans files and processes when they are accessed or started | On |
| Cloud-delivered protection | Sends metadata or samples to the cloud for rapid verdicts | On |
| Block at first sight | Holds unknown files until the cloud returns a verdict | On with cloud protection |
| Behavior monitoring | Watches process activity for malicious patterns | On |
| AMSI integration | Inspects PowerShell, VBScript and macro content before execution | On |
| Tamper protection | Prevents malware from disabling security settings | On in current releases |
| PUA protection | Blocks potentially unwanted applications such as bundleware | Varies by edition |
Updates arrive on three separate channels: security intelligence updates several times a day, engine updates and platform updates roughly monthly. A device can therefore show current signatures while still running an outdated platform, which is a common audit finding.
Detections are handled according to threat severity and configured remediation actions. By default, malicious files are moved to quarantine under the ProgramData folder, where an administrator can restore a false positive or delete the item permanently. Every action is written to the Windows event log under the Windows Defender operational channel, with event ID 1116 for a detection and 1117 for the action taken.
The Microsoft Defender product family
Outside the built-in antivirus, Microsoft uses the Defender name for commercial security services, most of which are licensed through Microsoft 365 or Azure plans. They share telemetry but solve different problems.
| Product | Protects | Typical customer |
|---|---|---|
| Defender Antivirus | Individual Windows devices | Every Windows user |
| Defender for Endpoint | Fleets of devices with detection and response | Organizations with a security team |
| Defender for Business | Endpoints in small and medium businesses | Companies up to 300 users |
| Defender for Office 365 | Email and collaboration tools | Microsoft 365 tenants |
| Defender for Identity | On-premises Active Directory | Hybrid identity environments |
| Defender XDR | Correlated incidents across all of the above | Security operations centers |
Microsoft Defender SmartScreen, which checks downloads and websites by reputation, also carries the brand but is a separate Windows component with its own settings. The Windows Security app is only the user interface that displays the status of these components; it is not itself a protection engine.
Coexistence with other antivirus products
Windows allows only one active antivirus to provide real-time protection. When a third-party product registers with Windows Security Center, Defender Antivirus switches to a disabled or passive mode to avoid conflicts, and returns automatically if that product is removed or expires.
In passive mode, used on devices onboarded to Defender for Endpoint, the engine still scans and reports but does not block. Users can also enable periodic scanning, a limited on-demand mode that runs alongside another antivirus. Note that features such as attack surface reduction rules and controlled folder access work only when Defender Antivirus is the primary engine. Running two real-time scanners at once is not supported and typically causes slow file access and unpredictable blocking.
Managing Defender from the command line
Administrators manage Defender through Group Policy, Intune, PowerShell or the legacy command-line tool MpCmdRun.exe. The PowerShell Defender module offers the most complete control on a single machine.
| Command | Purpose | Note |
|---|---|---|
Get-MpComputerStatus | Shows engine, signature and protection status | First step in troubleshooting |
Update-MpSignature | Downloads the latest security intelligence | Works without Windows Update UI |
Start-MpScan -ScanType QuickScan | Runs a quick scan | FullScan scans all files |
Set-MpPreference | Changes protection settings | May be blocked by tamper protection |
Add-MpPreference -ExclusionPath | Adds a folder exclusion | Use sparingly |
MpCmdRun.exe -Scan -ScanType 2 | Full scan from the legacy tool | Useful in scripts and recovery |
For persistent rootkits, Microsoft Defender Offline scan restarts the PC into a trusted environment and scans before Windows loads, which catches malware that hides from a running system.
Misconfigurations that weaken protection
Microsoft Defender Antivirus performs well in independent tests when its default cloud features stay enabled. Most real-world failures come from configuration rather than engine weakness.
| Mistake | Effect | Recommendation |
|---|---|---|
| Broad folder exclusions | Malware runs unscanned from excluded paths | Exclude specific files or processes only |
| Cloud protection disabled | Slower detection of new threats | Keep cloud and sample submission on |
| Tamper protection off | Malware can switch protection off | Enforce tamper protection centrally |
| Stale platform version | Missing new detection capabilities | Monitor platform and engine versions |
Defender should be seen as one layer in defense in depth, alongside Windows Firewall, Smart App Control, exploit protection and timely patching, not as a complete security strategy on its own.
Put simply
Microsoft Defender is the security guard that comes with Windows. It checks every file and program as you open it and stops anything that looks dangerous, and it asks Microsoft’s cloud for a second opinion when something is new.
For most home users it is enough protection on its own, as long as Windows stays updated and its settings are left at their defaults. Businesses use bigger members of the same family to watch thousands of computers from one console.
In practice
An IT administrator at a law firm with 120 Windows 11 laptops notices in the Windows Security reports that several devices show recent signatures but a platform version that is months old. Running Get-MpComputerStatus confirms that these laptops were imaged from an outdated template and never received platform updates.
The administrator updates the deployment image, enables tamper protection for the whole fleet through Intune and removes a broad exclusion of a downloads folder added years earlier for an old document scanner. Cloud-delivered protection and block at first sight are confirmed on every device.
The result is a uniform, current configuration. A few weeks later, a malicious macro attachment is blocked by AMSI inspection before it can execute, and the event appears centrally for review.