Windows Security · The Windows Security App · Lesson 1 of 5

Microsoft Defender Antivirus

Scans, quarantine and the settings that keep Defender itself safe.

Scans, quarantine and history

You met Microsoft Defender Antivirus earlier. It is the free antivirus built into Windows, inside the Windows Security app. Now let's look at how it really works.

Real-time protection means Defender checks files the moment they arrive or open. It is always on in the background. Most threats are stopped here, before you ever run a scan.

A scan is when Defender looks through files on purpose. You start one from Virus & threat protection, then Scan options. There are four kinds:

• Quick scan checks the places malware hides most often. It takes a few minutes.
• Full scan checks every file and program. It can take an hour or more.
• Custom scan checks only a folder or drive you choose.
• Microsoft Defender Antivirus (offline scan) restarts the PC and scans before Windows loads. Some stubborn malware hides while Windows is running. Save your work first.

When Defender finds something, it usually puts it in quarantine. Quarantine is a locked box. The file is kept, but it can't run or harm anything.

Protection history is the list of what Defender found and what it did. Each entry shows the threat's name, how serious it is, and an action taken, such as Quarantined or Removed. You can open an entry for more details.

Some entries offer Allow on device. This lets the file run again. Only choose it if you are sure the file is safe, for example a tool from your work's IT team. If you didn't expect the file, leave it in quarantine or remove it.

On the practice computer, run a Quick scan, then a Full scan. When the Full scan finds a threat in Downloads, open Protection history and read the entry. Do not allow it.

Cloud help and Tamper Protection

Defender has more settings than an on and off switch. Open Virus & threat protection, then under its settings choose Manage settings. Here are the main ones.

Real-time protection is the always-on checking you just learned about. You can switch it off for a short time, but Windows turns it back on by itself. Leave it on.

Cloud-delivered protection lets Defender ask Microsoft's servers about a file it hasn't seen before. The cloud here just means Microsoft's computers on the internet. New threats appear every day. The cloud often knows about them within minutes, long before a regular update arrives. Leave it on.

Automatic sample submission sends a suspicious file to Microsoft to study. This helps the cloud learn about new threats. Defender asks first if the file might hold personal information.

Tamper Protection guards Defender itself. Some malware tries to switch off antivirus before it does its real damage. With Tamper Protection on, other apps can't change Defender's key settings, such as real-time protection. Only a person signed in as an admin, using the Windows Security app, can change them.

Here is a clue to watch for. Suppose you find real-time protection off, and you didn't turn it off. Or Tamper Protection is off for no reason. Treat that as a warning sign. Turn them back on, then run a full scan.

Exclusions are files or folders Defender skips. Malware and scammers sometimes add one to hide. Glance at this list now and then. If you see something you didn't add, remove it.

One more fact from earlier: if you install another antivirus, Defender turns itself off and lets that one take over. Windows Security still shows which one is active.