Windows 11 Defender: Scans, Real-time Protection and More

Windows 11 Defender, properly called Microsoft Defender Antivirus, is the antivirus built into every edition of Windows 11. It is on by default, updates itself through Windows Update and mostly works without you noticing. Knowing where its controls are still pays off: when you suspect an infection, when a file is blocked, or when you want to confirm protection is really on. This guide covers the Windows 11 Defender scan types, real-time protection, protection history and exclusions.

The steps apply to Windows 11 version 24H2 and 25H2 on both Home and Pro.

Where to find Defender

Defender does not have its own app. Its controls are in the Windows Security app:

1. Open Start, type Windows Security and open it. You can also go to Settings > Privacy & security > Windows Security and select Open Windows Security.
2. Select Virus & threat protection.

The page shows Current threats with a Quick scan button, Scan options, Protection history, Virus & threat protection settings, Protection updates and Ransomware protection (see our ransomware protection guide). The shield icon in the system tray opens the same app.

The four scan types

Select Scan options to choose:

Scan	What it checks	When to use it
Quick scan	Folders where threats are commonly found	Routine checks, or when something seems slightly off
Full scan	Every file and running program on the PC	After a suspicious download or a quick scan that found something
Custom scan	Only the files and folders you pick	Checking a USB drive or a downloads folder
Microsoft Defender Antivirus (offline scan)	Restarts the PC and scans from outside Windows	Malware that hides while Windows is running, or keeps returning

Pick one and select Scan now. Quick and full scans run in the background, so you can keep working. You can also right-click a file or folder in File Explorer and choose to scan it with Microsoft Defender (on the new menu it may be under Show more options).

Running an offline scan

The offline scan is the strongest option available without extra tools. Some malware, such as rootkits, can hide from a scan while Windows is running. The offline scan restarts the PC into the Windows Recovery Environment and scans before Windows loads.

1. Save your work and close open apps; the PC will restart.
2. In Scan options, select Microsoft Defender Antivirus (offline scan).
3. Select Scan now, then confirm.
4. The PC restarts, runs the scan and returns to Windows when it finishes.

Results appear afterwards in Protection history.

Real-time and cloud-delivered protection

Under Virus & threat protection settings, select Manage settings. The main switches are:

• Real-time protection. Scans files as they are opened, downloaded or run. You can turn it off briefly, but Windows Security turns it back on automatically after a short time. While it is off, files you open or download are not scanned.
• Cloud-delivered protection. Lets Defender check suspicious files against Microsoft’s cloud service for faster detection of new threats.
• Automatic sample submission. Sends suspicious files to Microsoft for analysis. You can turn it off if you prefer, at the cost of slower analysis of new threats.
• Tamper protection. Stops other apps from changing important Defender settings. Keep it on.

If all four are on, Defender is fully active. To make sure definitions are current, open Protection updates and select Check for updates.

If you see “No active antivirus provider” or a message that another app is providing protection, a third-party antivirus is installed. Defender turns itself off automatically when a compatible antivirus is active. You can still enable Periodic scanning under Microsoft Defender Antivirus options for a second opinion.

Protection history

Protection history lists detections and actions: threats quarantined, removed or allowed, and items blocked by features such as controlled folder access. Select an entry to see the threat name, the affected file and the actions available, such as Remove, Quarantine, Restore or Allow on device.

Use Restore or Allow only when you are certain a detection is a false positive, for example a tool you wrote yourself. If in doubt, leave it quarantined and search the threat name on Microsoft’s site.

Exclusions: use them sparingly

An exclusion tells Defender not to scan an item. It can be a File, a Folder, a File type (such as .iso) or a Process.

1. In Virus & threat protection settings, select Manage settings.
2. Scroll to Exclusions and select Add or remove exclusions.
3. Select Add an exclusion, choose the type and pick the item.

Microsoft warns that excluded items are not scanned, which can leave the PC vulnerable. Some practical rules:

• Exclude a specific file, not a whole drive or your Downloads folder.
• Never add an exclusion because a website or installer told you to.
• Remove exclusions when you no longer need them.

If Defender will not open or update

If Windows Security will not open, shows a blank window or fails to update definitions, restart first and install pending updates in Settings > Windows Update. Then run SFC and DISM RestoreHealth to repair system files. Uninstalled third-party antivirus software can also leave pieces behind; use the vendor’s own removal tool.

For how Defender fits with the firewall, Smart App Control and memory integrity, see the Windows 11 security hub.