Windows Defender Settings to Turn On (And How to Check It Is Working)

Quick answer: Open Windows Security and confirm that Real-time protection, Cloud-delivered protection and Tamper Protection are all on. Then make three changes most people never make: set Potentially unwanted app blocking to block both apps and downloads, turn on Controlled folder access (the ransomware protection), and enable Memory integrity under Device security. Finish by running Get-MpComputerStatus in PowerShell to confirm Defender is actually the active antivirus and its definitions are current.

Microsoft Defender Antivirus, which nearly everyone still calls Windows Defender, is the security software most Windows users run without ever opening it. That is mostly fine. It scores well in independent lab testing, it updates itself, and for a typical home user it is enough, which we have argued at length in our Defender vs paid antivirus comparison.

But "enough" assumes it is configured the way the lab testers configure it. On a lot of machines it is not. Microsoft ships several of Defender's best features off, in audit mode, or buried three menus deep, because every one of them carries a small risk of blocking something legitimate and generating a support call. The lab results describe Defender with the gloves on. Your PC may be running it with the gloves in a drawer.

This guide is the short list of settings worth changing, what each one actually does, and the honest trade-off attached to each. Total time is about five minutes plus a reboot.

First, check Defender is the one actually running

Before tuning anything, confirm Defender is on duty at all. Machines that once had McAfee, Norton or a bundled trial installed often end up with Defender in passive mode, quietly deferring to a product whose subscription lapsed two years ago.

Open Terminal or PowerShell and run:

Get-MpComputerStatus | Select AMRunningMode, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated

What you want to see:

• AMRunningMode: Normal. If it says Passive or EDR Block Mode, another antivirus is registered as primary. If that product is expired, uninstall it with the vendor's own removal tool and Defender takes over automatically.
• RealTimeProtectionEnabled: True.
• IsTamperProtected: True.
• AntivirusSignatureLastUpdated within the last day or two. If it is older, run Update-MpSignature and check that Windows Update is not paused.

This one command catches the most dangerous configuration of all: a PC whose owner believes it is protected and is not.

The core three: confirm they are on

Go to Windows Security, Virus & threat protection, then Manage settings under Virus & threat protection settings.

Real-time protection. Scans files as they are opened, downloaded and executed. Should be on. If you switched it off for a game installer or a modding tool, our guide to turning off Windows Defender explains the exclusion approach that solves the original problem without leaving the whole machine open.

Cloud-delivered protection. This is the setting that makes Defender competitive with paid products. When Defender meets a file it does not recognise, it checks with Microsoft's cloud service, which can return a verdict in milliseconds based on what it has seen on millions of other machines. With it off, Defender falls back to locally stored definitions, which are always hours behind. Leave it on, along with Automatic sample submission, which lets the cloud service analyse suspicious files.

Tamper Protection. Prevents malware (or a script you ran without reading) from switching Defender's protections off behind your back. Modern malware often tries to disable the antivirus as its first move. Tamper Protection is what stops that from working. Leave it on.

Change 1: Block potentially unwanted apps, properly

Go to Windows Security, App & browser control, Reputation-based protection settings.

Find Potentially unwanted app blocking and make sure it is on with both boxes ticked: Block apps and Block downloads.

Potentially unwanted apps are not quite malware. They are the bundled toolbars, "driver updaters", coupon extensions and fake PC cleaners that ride along with free software installers. They slow machines down, inject ads, and often open the door to worse. Microsoft turned PUA blocking on by default for consumers in 2021, but its own documentation lists audit mode (detect and log, but do not block) as the default in some Windows 11 configurations. Audit mode protects nobody. Ticking both boxes removes the ambiguity.

The trade-off: occasionally a legitimate but aggressively bundled installer gets blocked. That is a feature. If you trust it, you can allow it from Protection history.

While you are on this screen, leave Check apps and files and SmartScreen for Microsoft Edge on. SmartScreen is a reputation check rather than a virus scan, and our SmartScreen guide covers when its warnings are worth obeying.

Change 2: Turn on Controlled folder access

This is the most valuable setting in Defender that almost nobody uses.

Go to Virus & threat protection, scroll to Ransomware protection, choose Manage ransomware protection, and turn on Controlled folder access.

It works on a simple principle. Your Documents, Pictures, Videos, Music, Desktop and Favorites folders become protected, and only applications Microsoft recognises as trustworthy can modify files inside them. Ransomware works by encrypting exactly those files. With Controlled folder access on, an unknown program that suddenly tries to rewrite 4,000 photos simply gets refused.

The honest trade-off: it will block some legitimate programs too, typically older software, niche utilities, games that write save files into Documents, and some backup tools. When that happens, Windows shows a notification. Go to Allow an app through Controlled folder access, add the program, and it will not be blocked again. Expect to do this two or three times in the first week, then never think about it again.

You can also add folders. If you keep important work somewhere else, such as a second drive, add it under Protected folders.

One more ransomware setting on the same page: if you use OneDrive, sign in under Ransomware data recovery. That links Defender to OneDrive's file restore feature, which can roll your files back to a point before an attack. Our ransomware protection guide covers the backup side in more detail.

Change 3: Enable Memory integrity

Go to Windows Security, Device security, Core isolation details, and turn on Memory integrity. Reboot.

Memory integrity (Microsoft also calls it HVCI) uses the virtualisation features in your processor to wall off the part of Windows that decides which drivers are allowed to load. That makes it far harder for malware to load a malicious kernel driver, which is how the most persistent infections dig in. New Windows 11 machines usually have it on. Machines upgraded from Windows 10 often do not.

If Windows refuses to turn it on, it will list the incompatible drivers. These are usually old drivers for hardware you no longer use. Updating or removing them is worth doing anyway.

On the same screen, leave Microsoft Vulnerable Driver Blocklist on, and turn on Local Security Authority protection if it is offered. That second one protects your stored Windows credentials from password-dumping tools.

The trade-off: a very small performance cost, mostly unnoticeable on hardware from the last five years. Some older anti-cheat systems and hardware utilities refuse to run with it on. If a specific game demands you turn it off, that is a decision about that game, not a reason to leave it off permanently.

Smart App Control: worth a look, not mandatory

On clean installs of Windows 11, App & browser control may also show Smart App Control. It blocks any app that is neither signed nor known-good in Microsoft's cloud. It is strong protection, and it is also the setting most likely to block software you actually want.

Until early 2026, switching it off was permanent without reinstalling Windows. Microsoft's spring 2026 cumulative updates removed that restriction, so on an up-to-date machine you can now turn it off to install a trusted tool and turn it back on afterward. If your PC was upgraded from Windows 10 rather than clean installed, the option will not appear at all, and that is normal.

Scans: what to run and when

Defender runs a quick scan during Windows' automatic maintenance, so you do not need to schedule one. What you should do:

Run a full scan once after setting all of this up, to establish a clean baseline. Virus & threat protection, Scan options, Full scan. It takes 30 minutes to a few hours depending on the drive.

Run an offline scan when something feels wrong. Scan options, Microsoft Defender Antivirus (offline scan). The PC restarts and scans before Windows loads, which catches rootkits and malware that hide from a running system. It takes about 15 minutes. Our malware scanner guide walks through what to do with the results.

If you want a weekly full scan on a fixed schedule, open Task Scheduler, go to Task Scheduler Library, Microsoft, Windows, Windows Defender, and edit the trigger on Windows Defender Scheduled Scan. That is more reliable than third-party schedulers and costs nothing.

Where Defender still falls short

Defender is a solid single layer, but it is still a single layer. Every detection on your PC comes from one engine and one set of cloud intelligence. When something new slips past that engine, there is nothing behind it to catch the miss. That is rare, but it is the reason security people keep a second-opinion scanner for the days when a machine acts strangely and Defender insists everything is fine.

The free option is Microsoft's own offline scan, described above, followed by a free on-demand scanner. If you want a second engine you can run on demand without uninstalling Defender, Iolo Malware Killer uses different, behaviour-based detection and is built specifically to sit alongside your primary antivirus rather than fight it. It is not a replacement for anything in this guide. It is what you reach for after this guide, when the settings are right and the symptoms persist.

What Defender does not try to do at all: identity theft monitoring, a VPN, a password manager. If you want those, buy them as separate tools you will actually use, rather than as part of a suite that also replaces an antivirus that was already good.

The five-minute checklist

1. Run Get-MpComputerStatus and confirm Normal mode, real-time on, Tamper Protection on, fresh definitions
2. Confirm Real-time, Cloud-delivered protection, sample submission and Tamper Protection are on
3. Potentially unwanted app blocking: on, with Block apps and Block downloads both ticked
4. Controlled folder access: on, then allow your trusted apps as they come up
5. Memory integrity: on, plus LSA protection if offered, then reboot
6. Run one full scan to set a baseline

That is the whole job. It costs nothing, takes less time than reading a paid antivirus sales page, and closes most of the gap between Defender on your PC and Defender in the lab.

Frequently Asked Questions

Is Microsoft Defender Antivirus good enough on its own in 2026?

For most home users, yes, provided it is configured properly. Independent labs consistently rate its detection highly. The gaps are mostly in settings that ship off or in audit mode, such as Controlled folder access and full PUA blocking, so turning those on matters more than switching products.

How do I know if Microsoft Defender is actually on?

Run Get-MpComputerStatus in PowerShell. AMRunningMode should read Normal and RealTimeProtectionEnabled should read True. If the mode is Passive, another antivirus is registered as your primary, and if that product has expired, your PC may have weaker protection than you think.

Will Controlled folder access break my programs?

It can block legitimate programs that write to protected folders, especially older software and some games. Windows notifies you when it blocks something, and you can allow that specific app in a few clicks. Most people only need to do this a handful of times.

Does Memory integrity slow down my PC?

On hardware from roughly the last five years the impact is small and rarely noticeable. Some older drivers and a few anti-cheat systems are incompatible with it. Windows tells you which drivers are blocking it, and updating or removing them is usually the fix.

Should I run a full scan regularly?

Defender's automatic quick scans plus real-time protection handle routine coverage. Run a full scan after first configuring Defender and an offline scan whenever the PC behaves oddly. A weekly scheduled full scan is optional and can be set in Task Scheduler.

Do I need another antivirus alongside Defender?

Not a second real-time antivirus; two resident scanners interfere with each other. An on-demand second-opinion scanner that runs only when you ask it to is a different matter, and it is a reasonable addition if you want a different detection engine to check Defender's work.