How do you check if Microsoft Defender is enabled?

Skip to main content

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Microsoft Defender Antivirus in Windows

  • Article
  • 10/03/2022
  • 3 minutes to read

In this article

Applies to:

  • Microsoft Defender for Endpoint Plans 1 and 2
  • Microsoft Defender for Business
  • Microsoft Defender Antivirus

Platforms

  • Windows

Microsoft Defender Antivirus is available in Windows 10 and Windows 11, and in versions of Windows Server.

Microsoft Defender Antivirus is a major component of your next-generation protection in Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat resistance research, and the Microsoft cloud infrastructure to protect devices (or endpoints) in your organization. Microsoft Defender Antivirus is built into Windows, and it works with Microsoft Defender for Endpoint to provide protection on your device and in the cloud.

Compatibility with other antivirus products

If you're using a non-Microsoft antivirus/antimalware product on your device, you might be able to run Microsoft Defender Antivirus in passive mode alongside the non-Microsoft antivirus solution. It depends on the operating system used and whether your device is onboarded to Defender for Endpoint. To learn more, see Microsoft Defender Antivirus compatibility.

Comparing active mode, passive mode, and disabled mode

The following table describes what to expect when Microsoft Defender Antivirus is in active mode, passive mode, or disabled.

ModeWhat happens
Active mode In active mode, Microsoft Defender Antivirus is used as the primary antivirus app on the device. Files are scanned, threats are remediated, and detected threats are listed in your organization's security reports and in your Windows Security app.
Passive mode In passive mode, Microsoft Defender Antivirus is not used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats are not remediated by Microsoft Defender Antivirus.

IMPORTANT: Microsoft Defender Antivirus can run in passive mode only on endpoints that are onboarded to Microsoft Defender for Endpoint. See Requirements for Microsoft Defender Antivirus to run in passive mode.

Disabled or uninstalled When disabled or uninstalled, Microsoft Defender Antivirus is not used. Files are not scanned, and threats are not remediated. In general, we do not recommend disabling or uninstalling Microsoft Defender Antivirus.

To learn more, see Microsoft Defender Antivirus compatibility.

Check the state of Microsoft Defender Antivirus on your device

You can use one of several methods, such as the Windows Security app or Windows PowerShell, to check the state of Microsoft Defender Antivirus on your device.

Use the Windows Security app to check the status of Microsoft Defender Antivirus

  1. On your Windows device, select the Start menu, and begin typing Security. Then open the Windows Security app in the results.

  2. Select Virus & threat protection.

  3. Under Who's protecting me?, choose Manage Providers.

You'll see the name of your antivirus/antimalware solution on the security providers page.

Use PowerShell to check the status of Microsoft Defender Antivirus

  1. Select the Start menu, and begin typing PowerShell. Then open Windows PowerShell in the results.

  2. Type Get-MpComputerStatus.

  3. In the list of results, look at the AMRunningMode row.

    • Normal means Microsoft Defender Antivirus is running in active mode.

    • Passive mode means Microsoft Defender Antivirus running, but is not the primary antivirus/antimalware product on your device. Passive mode is only available for devices that are onboarded to Microsoft Defender for Endpoint and that meet certain requirements. To learn more, see Requirements for Microsoft Defender Antivirus to run in passive mode.

    • EDR Block Mode means Microsoft Defender Antivirus is running and Endpoint detection and response (EDR) in block mode, a capability in Microsoft Defender for Endpoint, is enabled. Check the ForceDefenderPassiveMode registry key. If its value is 0, it is running in normal mode; otherwise, it is running in passive mode.

    • SxS Passive Mode means Microsoft Defender Antivirus is running alongside another antivirus/antimalware product, and limited periodic scanning is used.

Tip

To learn more about the Get-MpComputerStatus PowerShell cmdlet, see the reference article Get-MpComputerStatus.

Get your antivirus/antimalware platform updates

It's important to keep Microsoft Defender Antivirus (or any antivirus/antimalware solution) up to date. Microsoft releases regular updates to help ensure that your devices have the latest technology to protect against new malware and attack techniques. To learn more, see Manage Microsoft Defender Antivirus updates and apply baselines.

See also

  • Microsoft Defender Antivirus management and configuration
  • Evaluate Microsoft Defender Antivirus protection

Feedback

Submit and view feedback for

How do I make sure Microsoft Defender is on?

Turn Microsoft Defender Antivirus real-time protection on or off.
Select Start > Settings > Update & Security > Windows Security and then Virus & threat protection > Manage settings. ... .
Switch the Real-time protection setting to Off and choose Yes to verify..

Is Windows Defender automatically on?

Like other anti-malware applications, Windows Defender automatically runs in the background, scanning files when they are accessed and before user open them. When a malware is detected, Windows Defender inform you. It won't ask you what you want to do with the malicious software it finds.

How do I know if my Windows Defender is running for endpoint?

Troubleshoot onboarding issues.
Check that there is a Microsoft Defender for Endpoint Service running in the Processes tab in Task Manager. ... .
Check Event Viewer > Applications and Services Logs > Operation Manager to see if there are any errors..
In Services, check if the Microsoft Monitoring Agent is running on the server..