Skip to content

microsoft-defender-security-center-antivirus.md

Latest commit

 

History

History
139 lines (85 loc) · 8.63 KB

microsoft-defender-security-center-antivirus.md

File metadata and controls

139 lines (85 loc) · 8.63 KB

title: Microsoft Defender Antivirus in the Windows Security app description: With Microsoft Defender Antivirus now included in the Windows Security app, you can review, compare, and perform common tasks. ms.service: defender-endpoint ms.localizationpriority: medium ms.topic: how-to author: chrisda ms.author: chrisda ms.custom: nextgen ms.reviewer: yongrhee manager: bagol ms.subservice: ngp ms.collection:

  • m365-security
  • tier2 search.appverid: met150 ms.date: 04/09/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft Defender Antivirus #customer intent: As an IT admin or endpoint operator, I want a concise how‑to on using the Windows Security app to view and manage Microsoft Defender Antivirus settings so I can verify protection, run scans, and configure exclusions on endpoints.

Microsoft Defender Antivirus in the Windows Security app

Beginning with Windows 10, version 1703 and later, Microsoft Defender Antivirus settings are viewable in the Windows Security app. See Windows Security for more information about security features and settings that are built into Windows.

Important

Disabling the Windows Security app doesn't disable Microsoft Defender Antivirus or Windows Firewall. These capabilities are disabled or set to passive mode when non-Microsoft antivirus/antimalware software is installed on the device and kept up to date. If you do disable the Windows Security app, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products that are installed on the device. It might also prevent Microsoft Defender Antivirus from re-enabling when you uninstall any non-Microsoft antivirus/antimalware software. Disabling the Windows Security app can significantly lower the level protection of your device and could lead to malware infection.

Review virus and threat protection settings in the Windows Security app

  1. Open the Windows Security app by searching the start menu for Windows Security.

  2. Select Virus & threat protection.

  3. Use one or more of the subsequent sections to perform tasks using the Windows Security app.

Note

If these settings are configured and deployed using Group Policy, the settings described in this section are grayed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting are updated in Windows Settings. The Configure end-user interaction with Microsoft Defender Antivirus topic describes how local policy override settings can be configured.

Run a scan with the Windows Security app

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Select Quick scan. Or, to run a full scan, select Scan options, and then select an option, such as Full scan.

Review the security intelligence update version and download the latest updates in the Windows Security app

:::image type="content" source="/defender/media/wdav-wdsc-defs.png" alt-text="Security intelligence version number" lightbox="/defender/media/wdav-wdsc-defs.png":::

Note

The security intelligence version shown in the Windows Security app is the same as what was previously referred to as the definition version of Microsoft Defender Antivirus.

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Select Virus & threat protection updates. The currently installed version is displayed along with some information about when it was downloaded. You can check your current against the latest version available for manual download, or review the change log for that version. See Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware.

  4. Select Check for updates to download new protection updates (if there are any).

Tip

If you have your Microsoft Defender Antivirus updates (Security intelligence, Engine, and Platform), pointing to a WSUS or Software Update Point, and if you have the Windows Update policy set to 3 - Auto download and notify for install, when you select Check for updates, all available Microsoft Defender Antivirus updates are installed.

Ensure Microsoft Defender Antivirus is enabled in the Windows Security app

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Select Virus & threat protection settings.

  4. Toggle the Real-time protection switch to On.

    [!NOTE] If you switch Real-time protection off, it will automatically turn back on after a short delay. This automatic enablement is to ensure you're protected from malware and threats. If you install another antivirus product, Microsoft Defender Antivirus automatically disables itself and is indicated as such in the Windows Security app. A setting appears that allows you to enable limited periodic scanning.

Add exclusions for Microsoft Defender Antivirus in the Windows Security app

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Under Virus & threat protection settings, select Manage settings.

  4. Under Exclusions, select Add or remove exclusions.

  5. Select the plus icon (+) to choose the type and set the options for each exclusion.

The following table summarizes exclusion types and what happens:

Exclusion type Defined by What happens
File Location
Example: c:\sample\sample.test		 The specific file is skipped by Microsoft Defender Antivirus.
Folder Location
Example: c:\test\sample		 All items in the specified folder are skipped by Microsoft Defender Antivirus.
File type File extension
Example: .test		 All files with the .test extension anywhere on your device are skipped by Microsoft Defender Antivirus.
Process Executable file path
Example: c:\test\process.exe		 The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus.

To learn more, see the following resources:

Review threat detection history in the Windows Defender app

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Select Protection history. Any recent items are listed.

Set ransomware protection and recovery options

  1. Open the Windows Security app by searching the start menu for Security, and then selecting Windows Security.

  2. Select the Virus & threat protection tile (or the shield icon on the left menu bar).

  3. Under Ransomware protection, select Manage ransomware protection.

  4. To change Controlled folder access settings, see Protect important folders with Controlled folder access.

  5. To set up ransomware recovery options, select Set up under Ransomware data recovery and follow the instructions for linking or setting up your OneDrive account so you can easily recover from a ransomware attack.

See also