Configuring Windows Defender

What is Windows Defender?

Windows Defender, officially known as Microsoft Defender Antivirus, is the built-in security solution that comes pre-installed with Windows 10 and Windows 11. It provides real-time protection against viruses, malware, spyware, and other threats without requiring any additional software or subscriptions.

Unlike third-party antivirus programs, Defender is deeply integrated into the operating system. It receives updates through Windows Update, runs with minimal performance impact, and is maintained by Microsoft's dedicated security research team. For most users, it provides all the protection needed when properly configured.

Verifying Defender is Active

Before configuring anything, you should confirm that Windows Defender is actually running on your system. Third-party antivirus software can disable Defender automatically during installation, so it is important to verify.

Method 1: Windows Security App

Method 2: PowerShell Verification

For a quick command-line check, open PowerShell as Administrator and run:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AMServiceEnabled

All three values should return True. If AntivirusEnabled shows False, another antivirus product has taken over and Defender is in passive mode.

Running Scans

Windows Defender offers several scan types, each suited to different situations. Understanding when to use each type helps you maintain thorough protection without wasting time on unnecessary full system scans.

Quick Scan

A Quick Scan checks the areas where malware is most commonly found: running processes, the Windows registry, common startup folders, and the system directories. It typically completes in 5 to 15 minutes and is sufficient for routine daily checks.

From PowerShell (as Administrator):

Start-MpScan -ScanType QuickScan

Full Scan

A Full Scan examines every file on every drive connected to your computer. This includes external USB drives and mapped network shares. It can take anywhere from one to several hours depending on the amount of data on your system.

Use a Full Scan when:

• You suspect your computer is infected despite a clean Quick Scan result
• You have just removed malware and want to verify the system is clean
• You have not run a full scan in over a month
• You have connected an external drive from an untrusted source

To start a Full Scan, go to Virus & threat protection, click Scan options, select Full scan, and click Scan now.

Start-MpScan -ScanType FullScan

Custom Scan

A Custom Scan lets you target specific files or folders. This is useful when you want to scan a downloaded file, a USB drive, or a particular directory without scanning the entire system.

To run a Custom Scan from PowerShell on a specific path:

Start-MpScan -ScanType CustomScan -ScanPath "D:\Downloads"

Microsoft Defender Offline Scan

The Offline Scan restarts your computer into a minimal recovery environment and scans before Windows fully loads. This is effective against rootkits and other threats that can hide from scans while the operating system is running.

Start-MpWDOScan

Updating Virus Definitions

Virus definitions (also called security intelligence) are the database that Defender uses to identify known threats. Microsoft releases definition updates multiple times per day. Keeping definitions current is one of the most important things you can do for your security.

Automatic Updates

By default, Windows Defender downloads definition updates automatically through Windows Update. As long as your computer is connected to the internet and Windows Update is not paused, definitions should stay current without any action on your part.

Manual Update

If you want to force an immediate update (for example, before running a scan), you can trigger it manually:

From PowerShell:

Update-MpSignature

To check when definitions were last updated:

Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated, AntivirusSignatureVersion

Configuring Real-Time Protection

Real-time protection is the core feature of Windows Defender. It monitors file system activity, network connections, and process behavior continuously, intercepting threats as they appear rather than waiting for a scheduled scan to find them.

Verifying Real-Time Protection

Recommended Settings

Managing Exclusions

Exclusions tell Defender to skip certain files, folders, file types, or processes during scans and real-time monitoring. This is useful for development environments, virtual machines, or applications that Defender incorrectly flags as threats.

Adding an Exclusion

Common exclusion scenarios:

• Development folders: Exclude project build directories (e.g., node_modules, target, .cargo) to improve build performance.
• Virtual machines: Exclude VM disk files (.vhd, .vhdx, .vmdk) to avoid scan overhead.
• Trusted applications: Exclude processes for software you trust that triggers false positives.

To add an exclusion via PowerShell:

# Exclude a folder
Add-MpPreference -ExclusionPath "C:\Projects\my-app"

# Exclude a file type
Add-MpPreference -ExclusionExtension ".vmdk"

# Exclude a process
Add-MpPreference -ExclusionProcess "myapp.exe"

# View current exclusions
Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Scheduling Scans

While real-time protection catches threats as they appear, periodic scheduled scans provide an additional layer of assurance by checking files that may have been missed or that existed before a definition update was applied.

Using Task Scheduler

Windows Defender uses Task Scheduler for its scan schedules. You can customize when and how scans run:

PowerShell Scan Scheduling

You can configure the scheduled scan type and day using PowerShell:

# Set scan to run every Sunday at 2:00 AM
Set-MpPreference -ScanScheduleQuickScanTime 02:00:00

# Set the scheduled scan day (0=Everyday, 1=Sunday, 2=Monday, ..., 7=Saturday)
Set-MpPreference -ScanScheduleDay 1

# Set scan type (1=Quick, 2=Full)
Set-MpPreference -ScanParameters 2

# Check current schedule
Get-MpPreference | Select-Object ScanScheduleDay, ScanScheduleQuickScanTime, ScanParameters

Now Do It Yourself: Break a Signature Scanner in One Character

The page above tells you to keep definitions updated. That is good advice built on an assumption worth testing: that a definition list is what catches malware. In twenty minutes you can build a working scanner, watch a single capital letter walk straight past it, and see why Defender needs the other layers it ships with.

You need Python 3. Nothing malicious is created or downloaded — the “sample” is three lines of ordinary English that does nothing at all. Steps 1–4 were run on Linux to produce every output below; step 5 is Windows and is marked where it could not be.

printf 'This file stands in for a piece of malware.\nIt does nothing at all - it is ordinary text.\nWhat matters is its exact bytes.\n' > sample.txt
sha256sum sample.txt

084c702bc4201052d95ad64bbf867345c2b0f2382bc450f312bfc7245fb49a24  sample.txt

import hashlib, sys, pathlib

# A signature database: exact file hashes known to be bad. This is how the earliest
# antivirus worked, and it is still one layer of how modern ones work.
KNOWN_BAD = {
    "084c702bc4201052d95ad64bbf867345c2b0f2382bc450f312bfc7245fb49a24": "Sample.Test.A",
}

# A behavioural rule: not the file's identity, but something about what it contains.
SUSPICIOUS_PATTERNS = [
    (b"stands in for a piece of", "Sample.Test.Generic"),
]

for name in sys.argv[1:]:
    data = pathlib.Path(name).read_bytes()
    digest = hashlib.sha256(data).hexdigest()

    hit = KNOWN_BAD.get(digest)
    if hit:
        print(f"{name:<14} SIGNATURE MATCH   {hit}")
        continue

    for pattern, label in SUSPICIOUS_PATTERNS:
        if pattern in data:
            print(f"{name:<14} PATTERN MATCH     {label}  (hash unknown: {digest[:12]}…)")
            break
    else:
        print(f"{name:<14} clean             (hash {digest[:12]}…)")

sed '/stands in for a piece of/d' scanner.py > scanner_hashonly.py
python3 scanner_hashonly.py sample.txt

sample.txt     SIGNATURE MATCH   Sample.Test.A

sed 's/a piece of malware/a piece of Malware/' sample.txt > sample2.txt
sha256sum sample.txt sample2.txt
python3 scanner_hashonly.py sample.txt sample2.txt

084c702bc4201052d95ad64bbf867345c2b0f2382bc450f312bfc7245fb49a24  sample.txt
f5dfa285163c7e531fc2a19bca6f8fe0bbef7a3e26687c92232c3e81588087b4  sample2.txt
sample.txt     SIGNATURE MATCH   Sample.Test.A
sample2.txt    clean             (hash f5dfa285163c…)

python3 scanner.py sample.txt sample2.txt

sample.txt     SIGNATURE MATCH   Sample.Test.A
sample2.txt    PATTERN MATCH     Sample.Test.Generic  (hash unknown: f5dfa285163c…)

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, BehaviorMonitorEnabled, AntivirusSignatureLastUpdated

Summary

In this tutorial, you learned how to:

• Verify that Windows Defender is active and running properly
• Run different scan types (Quick, Full, Custom, and Offline) for different situations
• Update virus definitions manually and verify they are current
• Configure real-time protection settings for optimal security
• Set up exclusions for development tools and virtual machines
• Schedule automatic scans using Task Scheduler and PowerShell