Windows Defender: setup, scans, protection, troubleshooting

Microsoft Defender is already built into Windows, so in many cases you don’t need to install anything extra to get antivirus protection. The first thing to check is whether it’s actually active and whether another antivirus has taken over. From there, you can turn on the settings that matter most, run the right scan when something looks off, and fix the common problems that stop protection or updates from working. If Defender says it’s off, start in Windows Security and check the active antivirus provider before changing anything else.

First, check whether Defender is already protecting your PC

Before you start

• You need access to the Windows desktop.
• If the PC is managed by work or school, some settings may be locked by policy.
• If another antivirus is installed, it may be the one controlling real-time protection.

Start in the Windows Security app. That’s where Microsoft Defender Antivirus shows its status, scan history, and protection settings.

1. Open the Start menu.
2. Type Windows Security and open the app.
3. Look at the home page for a green or normal status, then open Virus & threat protection.
4. Check the message at the top of that page. If it says Microsoft Defender Antivirus is on and no other provider is listed, Defender is active.

If you see that another antivirus is managing protection, Windows usually turns Defender into a backup or passive mode. That’s normal. A third-party security app can take over real-time protection, cloud checks, and scheduled scans. In that case, you’ll need to decide whether to keep the other antivirus or remove it if you want Defender to be the main protection.

You can also confirm the active provider in Virus & threat protection by looking for the security provider name. If the page warns that protection is off, that usually means another product is in charge, a Windows service is disabled, or the Security app needs repair.

What Windows Defender actually does for you

Defender is not just a scanner you run once in a while. Its normal job is to watch files and apps as you use the PC, check suspicious activity against Microsoft’s threat data, and update itself so it can recognize newer threats.

Real-time protection is the part most people rely on day to day. It checks downloads, USB files, scripts, and app behavior as they appear. If it catches something, Windows Security will usually quarantine or block it before it opens.

Cloud-delivered protection adds a second layer. When Defender sees something that looks unfamiliar, it can consult Microsoft’s cloud-based reputation and threat data instead of waiting only for a local signature update. That helps when a threat is new or changing quickly.

Defender also updates automatically through Windows Update and its own security intelligence updates. That matters because antivirus software that hasn’t updated in a while is far less useful. If you only remember one thing, it’s this: Defender works best when real-time protection is on, cloud checks are allowed, and updates are current.

The settings that matter most

These are the settings worth checking first because they affect everyday protection more than most of the others.

1. Open Windows Security.
2. Go to Virus & threat protection.
3. Open Manage settings under Virus & threat protection settings.
4. Make sure Real-time protection is turned on.
5. Turn on Cloud-delivered protection if it’s off.
6. Turn on Automatic sample submission so Defender can send suspicious samples when needed.
7. Leave Tamper Protection on unless you have a specific troubleshooting reason to change it.

Real-time protection should stay on for normal use. If you turn it off, Windows becomes much easier to infect while you browse, download, or open files.

Tamper Protection matters because it helps stop malware and even some unwanted software from switching off Defender settings behind your back. If a setting keeps flipping back, tamper protection is one of the first things to check.

Automatic sample submission can help Defender respond faster to unknown threats. If you are concerned about privacy, you can review that setting, but for most home users it should stay enabled.

If a switch is greyed out or won’t stay changed, that often points to another antivirus, a policy setting, or a Windows management policy on the device.

How to run a quick scan when you just want peace of mind

Use a quick scan when you want a fast check after opening a file, plugging in a USB drive, or noticing something minor but not alarming. It focuses on the places where malware usually hides first, so it finishes much faster than a full scan.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Under Current threats, choose Quick scan.

If Defender finds something, follow the action it recommends, usually quarantine or remove. If it finds nothing, that does not guarantee the whole PC is clean, but it does give you a good first pass.

A quick scan is usually the right choice after a one-off risk, like downloading an installer from a site you don’t fully trust or using a removable drive from another computer. It is not the best choice if the PC is showing repeated pop-ups, strange browser changes, or files that keep getting corrupted. In those cases, go broader.

When a full scan is the better choice

A full scan checks the whole machine, not just the common hot spots. Use it when you think something may already be on the PC, when a quick scan comes back clean but symptoms continue, or when you want a deeper check after a suspicious event.

1. Open Windows Security.
2. Go to Virus & threat protection.
3. Select Scan options.
4. Choose Full scan.
5. Select Scan now.

A full scan can take a while, especially on large drives or older hardware. It may still let you keep using the PC, but performance can slow down while the scan is running.

Pick this scan if you suspect a missed threat, a browser hijacker, or malware that may have settled into more than one folder. It is also a good follow-up after a quick scan finds something and you want to check for related files or leftovers. If the PC behaves oddly only sometimes, a full scan is the safer next step before you start changing lots of settings.

Use an offline scan for stubborn malware

Microsoft Defender Offline is the choice for threats that may hide while Windows is running. Some malware tries to protect itself by loading early, interfering with security tools, or hiding from normal scans. An offline scan restarts the computer into a special scanning environment before Windows fully loads, which makes those tricks harder to use.

1. Save your work and close open apps.
2. Open Windows Security.
3. Go to Virus & threat protection.
4. Select Scan options.
5. Choose Microsoft Defender Offline scan.
6. Select Scan now and let the PC restart.

Use this when a threat keeps coming back, when normal scans can’t remove something, or when you suspect a rootkit or similarly stubborn malware. The PC will be unavailable during the offline scan, so plan for that restart.

If the scan succeeds, Windows will boot back in normally and show the result in Security history or scan history. If the problem returns right away, that usually means there’s another source of infection or a setting that still needs attention.

Why protection might be turned off

If Defender says protection is off, the cause is often simple, but you need to narrow it down before changing random settings.

Common reasons include:

• Another antivirus is installed and taking over real-time protection.
• A Windows security service is stopped or disabled.
• Group policy or a work-managed device is controlling the setting.
• Tamper Protection or a security policy is preventing a change.
• The Windows Security app or security intelligence is damaged.
• A Windows update problem has left Defender in a bad state.

If you’re on a work or school PC, policy management may be the reason settings look locked. In that case, local changes may not stick.

If you recently installed or removed another antivirus, that’s a strong clue. Security products sometimes leave behind components that confuse Defender until the PC is restarted or the old product is fully removed. If protection turned off after a Windows change, the Security app or the Defender service itself may need repair.

If scans won’t start or updates keep failing

Start with the safest fixes first. Most scan and update problems come from a temporary Windows issue, a stuck service, or an app that needs a reset.

1. Restart the PC.
2. Open Windows Security and try the scan again.
3. Open Windows Update and install any pending updates.
4. Go back to Virus & threat protection and check for security intelligence updates.
5. If updates still fail, open Settings > Apps > Installed apps, find Windows Security, and use Advanced options if available to repair or reset it.

If Defender still won’t run, check that the Microsoft Defender Antivirus service is active. On many systems, the service is managed automatically, so you may only need to confirm that nothing else is disabling it. If another antivirus is installed, uninstalling it cleanly often fixes scan issues.

If you need a more direct check from an elevated prompt, you can look at the Defender status with PowerShell:

Get-MpComputerStatus

If that command errors, or if it shows protection features as off when they should be on, that points to a deeper Windows or policy issue rather than a normal scan problem.

How to confirm everything is working again

After you change a setting or fix a problem, confirm the result in Windows Security instead of assuming it stuck.

Check these signs:

• Virus & threat protection shows Microsoft Defender Antivirus active.
• Real-time protection is on.
• Cloud-delivered protection is on if you want Microsoft’s online threat checks.
• Protection updates show a current status instead of an error.
• Recent scan history shows the scan you just ran and its result.

If you ran a scan, look for a clean result or for actions taken against anything it found. If you changed a setting, leave the page and come back to make sure the switch stayed put. That matters more than the first screen you saw after the change.

You can also verify that Windows Security is no longer warning about protection being off. If the warnings are gone, the provider shown is Microsoft Defender Antivirus, and recent updates are current, Defender is back in working order.

When to reset, repair, or get help

Basic troubleshooting has a limit. If Windows Security won’t open, settings keep reverting, threats keep returning after removal, or Defender keeps failing after you remove another antivirus, it’s time to move beyond simple fixes.

At that point, repairing or resetting the Windows Security app is reasonable. So is checking system files with Windows repair tools if the app or security services seem damaged. If the device is managed by work or school policy, local repairs may not change much because the rules are coming from elsewhere.

If you still can’t get stable protection, or the same threat keeps reappearing after you clean it, treat that as a sign of a deeper issue. The next step may be a more thorough cleanup, a Windows repair install, or help from someone who can inspect the machine directly. The key point is not to keep toggling the same setting over and over when Defender clearly isn’t staying healthy.

Conclusion

Once Defender is active, the routine is simple: keep real-time protection and cloud-delivered protection on, let updates install, and use the scan type that matches the problem. Quick scans are good for fast reassurance, full scans for broader checks, and offline scans for stubborn threats. If something stops working, start with Windows Security, another antivirus, and Windows Update before you assume the PC is infected. After each fix, go back and confirm the status so you know Defender really recovered.

Frequently Asked Questions

Can I use Microsoft Defender and another antivirus at the same time?

Usually not for full real-time protection. Windows typically lets one antivirus take the lead. The other product may stay installed, but Defender often switches into a limited or passive role.

How often should I run a full scan?

There is no single schedule that fits everyone. A quick scan is enough for routine checks, while a full scan makes more sense after suspicious behavior, a missed threat, or a file source you don’t trust.

Why does Defender keep turning itself back on after I disable it?

That is often by design. Windows tries to keep core protection active, and Tamper Protection can stop changes that look risky. If another security tool is installed, Windows may also restore Defender when that tool is removed.

What should I do if Windows Security won’t open at all?

Restart first, then check Windows Update and repair or reset the Windows Security app if the problem continues. If the app still won’t open, the issue may be with Windows itself or with a management policy on the device.