Stay protected with Windows Security

Windows 10 includes Windows Security, which provides the latest antivirus protection. Your device will be actively protected from the moment you start Windows 10. Windows Security continually scans for malware (malicious software), viruses, and security threats. In addition to this real-time protection, updates are downloaded automatically to help keep your device safe and protect it from threats.

Windows 10 in S mode

Some features will be a little different if you’re running Windows 10 in S mode. Because this mode is streamlined for tighter security, the Virus & threat protection area has fewer options. But don’t worry—the built-in security of this mode automatically prevents viruses and other threats from running on your device, and you’ll receive security updates automatically. For more info, see Windows 10 in S mode FAQ.

Important security info

Windows Security is built-in to Windows 10 and includes an antirvirus program called Microsoft Defender Antivirus. (In previous versions of Windows 10, Windows Security is called Windows Defender Security Center).

If you have another antivirus app installed and turned on, Microsoft Defender Antivirus will turn off automatically. If you uninstall the other app, Microsoft Defender Antivirus will turn back on automatically.

If you’re having problems receiving Windows Security updates, see Fix Windows Update errors and the Windows Update FAQ.

For info on how to uninstall an app, see Repair or remove an app in Windows 10.

To change your user account to an admin account, see Create a local user or administrator account in Windows 10.

Understand and customize Windows Security features

Windows Security is your home to manage the tools that protect your device and your data:

Virus & threat protection. Monitor threats to your device, run scans, and get updates to help detect the latest threats. (Some of these options are unavailable if you’re running Windows 10 in S mode.)

Account protection. Access sign-in options and account settings, including Windows Hello and dynamic lock.

Firewall & network protection. Manage firewall settings and monitor what’s happening with your networks and internet connections.

App & browser control. Update settings for Microsoft Defender SmartScreen to help protect your device against potentially dangerous apps, files, sites, and downloads. You’ll have exploit protection and you can customize protection settings for your devices.

Device security. Review built-in security options to help protect your device from attacks by malicious software.

Device performance & health. View status info about your device’s performance health, and keep your device clean and up to date with the latest version of Windows 10.

Family options. Keep track of your kids’ online activity and the devices in your household.

You can customize how your device is protected with these Windows Security features. To access them, select Start > Settings > Update & Security > Windows Security . Then select the feature you want to explore.
Open Windows Security settings

Status icons indicate your level of safety:

Green means your device is sufficiently protected and there aren’t any recommended actions.

Yellow means there is a safety recommendation for you.

Red is a warning that something needs your immediate attention.

Run a malware scan manually

When you’re concerned about risks to a specific file or folder, you can right-click the file or folder in File Explorer, then select Scan with Microsoft Defender.

If you suspect there’s malware or a virus on your device, you should immediately run a quick scan. This is much faster than running a full scan on all your files and folders.

Run a quick scan in Windows Security

Select Start > Settings > Update & Security > Windows Security and then Virus & threat protection.
Open Windows Security settings

Under Current threats, select Quick scan (or in previous versions of Windows 10, under Threat history, select Scan now).

If the scan doesn’t find any issues, but you’re still concerned, you may want to check your device more thoroughly.

Run an advanced scan in Windows Security

Select Start > Settings > Update & Security > Windows Security and then Virus & threat protection.

Under Current threats, select Scan options (or in previous versions of Windows 10, under Threat history, select Run a new advanced scan).

Select one of the scan options:

Full scan (check files and programs currently running on your device)

Custom scan (scan specific files or folders)

Microsoft Defender Offline scan (run this scan if your device has been, or could potentially be, infected by a virus or malware). Learn more about Microsoft Defender Offline

Select Scan now.

Note: Because of streamlined security, this process isn’t available if you’re running Windows 10 in S mode.

Schedule your own scan

Even though Windows Security is regularly scanning your device to keep it safe, you can also set when and how often the scans occur.

Schedule a scan

Select the Start button, type schedule tasks in the Search box, and in the list of results, select Task Scheduler.

In the left pane, select the arrow (>) next to Task Scheduler Library to expand it, do the same with Microsoft > Windows, and then scroll down and select the Windows Defender folder.

In the top-center pane, select Windows Defender Scheduled Scan. (Point to the choices to see the full names.)

In the Actions pane on the right, scroll down and then select Properties.

In the window that opens, select the Triggers tab, and then select New.

Set your preferred time and frequency, and then select OK.

Review the schedule and select OK.

Note: Because of streamlined security, this process isn’t available if you’re running Windows 10 in S mode.

Turn Microsoft Defender Antivirus real-time protection on or off

Sometimes you may need to briefly stop running real-time protection. While real-time protection is off, files you open or download won’t be scanned for threats. However, real-time protection will soon turn on automatically again to protect your device.

Turn real-time protection off temporarily

Select Start > Settings > Update & Security > Windows Security and then Virus & threat protection > Manage settings. (In previous versions of Windows 10, select Virus & threat protection > Virus & threat protection settings.)
Open Windows Security settings

Switch the Real-time protection setting to Off and choose Yes to verify.

Note: Because of streamlined security, this process isn’t available if you’re running Windows 10 in S mode.

The Windows Security app

Applies to

• Windows 10, version 1703 and later

This library describes the Windows Security app, and provides information on configuring certain features, including:

In Windows 10, version 1709 and later, the app also shows information from third-party antivirus and firewall apps.

In Windows 10, version 1803, the app has two new areas, Account protection and Device security.

The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage Microsoft Defender for Endpoint.

You can’t uninstall the Windows Security app, but you can do one of the following:

• Disable the interface on Windows Server 2016. See Microsoft Defender Antivirus on Windows Server.
• Hide all of the sections on client computers (see below).
• Disable Microsoft Defender Antivirus, if needed. See Enable and configure Microsoft Defender AV always-on protection and monitoring.

You can find more information about each section, including options for configuring the sections — such as hiding each of the sections — at the following topics:

• Virus & threat protection, which has information and access to antivirus ransomware protection settings and notifications, including Controlled folder access, and sign-in to Microsoft OneDrive.
• Account protection, which has information and access to sign-in and account protection settings.
• Firewall & network protection, which has information and access to firewall settings, including Windows Defender Firewall.
• App & browser control, covering Windows Defender SmartScreen settings and Exploit protection mitigations.
• Device security, which provides access to built-in device security settings.
• Device performance & health, which has information about drivers, storage space, and general Windows Update issues.
• Family options, which includes access to parental controls along with tips and information for keeping kids safe online.

If you hide all sections then the app will show a restricted interface, as in the following screenshot:

Open the Windows Security app

Click the icon in the notification area on the taskbar.

Search the Start menu for Windows Security.

Open an area from Windows Settings.

Settings configured with management tools, such as Group Policy, Microsoft Intune, or Microsoft Endpoint Configuration Manager, will generally take precedence over the settings in the Windows Security. See the topics for each of the sections for links to configuring the associated features or products.

How the Windows Security app works with Windows security features

Microsoft Defender AV and the Windows Security app use similarly named services for specific purposes.

The Windows Security app uses the Windows Security Service (SecurityHealthService or Windows Security Health Servce), which in turn utilizes the Security Center service (wscsvc) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection.

These services do not affect the state of Microsoft Defender AV. Disabling or modifying these services will not disable Microsoft Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product.

Microsoft Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date]/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility).

Disabling the Windows Security Center service will not disable Microsoft Defender AV or Windows Defender Firewall.

If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device.

It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed.

This will significantly lower the protection of your device and could lead to malware infection.

The Windows Security app operates as a separate app or process from each of the individual features, and will display notifications through the Action Center.

It acts as a collector or single place to see the status and perform some configuration for each of the features.

Disabling any of the individual features (through Group Policy or other management tools, such as Microsoft Endpoint Configuration Manager) will prevent that feature from reporting its status in the Windows Security app. The Windows Security app itself will still run and show status for the other security features.

Individually disabling any of the services will not disable the other services or the Windows Security app.

For example, using a third-party antivirus will disable Microsoft Defender Antivirus. However, the Windows Security app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Defender Firewall.

Windows Security Center

Most of this page uses content from Wikipedia. The original article was at Windows Security Center. The list of authors can be seen in the page history. As with Computer Security Wiki, the text of Wikipedia is available under the GNU Free Documentation License. Remove this template when most of the Wikipedia content has been removed or the Wikipedia information is outnumbered by non-Wikipedia information.

The Windows Security Center is a component included with Windows XP (beginning with Service Pack 2) and Windows Vista operating systems that provides users with the ability to view the status of computer security settings and services. Windows Security Center also continually monitors these security settings, and informs the user via a pop-up notification balloon if there is a problem.

Contents

Overview [ edit | edit source ]

The Windows Security Center consists of three major components: A control panel, a Windows Service, and an application programming interface that is provided by Windows Management Instrumentation.

The control panel divides the monitored security settings into categories, the headings of which are displayed with a background color of light blue (green in Vista), yellow, or red. A category with a blue or green background indicates that the settings in the category are «healthy». A yellow background typically indicates that some or all of the settings in that category are not being monitored. A red background indicates that there is a problem that can expose the user’s computer to problems.

The current state of these settings is determined by the Windows Service. This service, named «Security Center», is started automatically when the computer starts, and takes responsibility for continually monitoring the system for changes, and also informs the user via a pop-up notification balloon if there is a problem. The settings are made available to the system through a Windows Management Instrumentation provider.

The primary interface which third-party anti-virus, anti-malware and firewall software vendors use to register with Windows Security Center is through the WMI provider. In Windows Vista, some Windows API calls were added to let applications retrieve the aggregate health status of Windows Security Center, and to receive notifications when the health status changes. Microsoft has offered suggestions that these new calls could be used by any application that wants to confirm that the system is in a healthy state before engaging in certain actions. An example they give is that a computer game could ensure that a firewall is running before connecting to a multi-player online game.

Versions [ edit | edit source ]

Windows XP [ edit | edit source ]

Windows Security Center in Windows XP.

During a 2003 marketing campaign aimed at raising awareness of security, Microsoft learned from discussions with customers that there was confusion as to whether users were taking appropriate steps to protect their systems, or if the steps they were taking were effective. [1] From this research, Microsoft made the decision to include a prominent and visible control panel with Windows XP Service Pack 2 that would provide a consolidated view of the most important security features. Service Pack 2 was released in August 2004; this initial version provides monitoring of Windows Update, Windows Firewall, and the availability of an anti-virus software package. Third-party providers of firewall and anti-virus software packages were encouraged to make use of the Windows Security Center application programming interface to ensure that their software would be recognised.

Windows Vista [ edit | edit source ]

Windows Security Center in Windows Vista.

Windows Vista adds anti-malware software detection, monitoring of User Account Control, and monitoring of several Internet Explorer security settings. Windows Defender, Microsoft’s anti-malware product, is included with Windows Vista by default, which Windows Security Center will monitor; a third-party anti-malware product can replace this. Another feature of the Windows Vista version is that it includes the ability to display logos of third-party products that have been registered with the Security Center.

Unlike Windows XP, in the beta versions of Windows Vista the Windows Security Center could not be disabled or overridden. Security software maker Symantec spoke out against this, noting that it would cause a great deal of consumer confusion because any security problems would be reported by both Windows Security Center and Symantec’s tools at the same time. [2] McAfee, another large security software vendor, lodged similar complaints, [3] and in the end Microsoft allowed Windows Security Center to be disabled in the release version of Vista. [4]

Windows 7 [ edit | edit source ]

Windows Security Center (or the Windows Action Center) in Windows 7.

In Windows 7 the Windows Security Center has been renamed the Windows Action Center (Windows Solution Center and Windows Health Center in earlier builds) which encompass both Security and Maintenance of the computer.

Criticism and controversy [ edit | edit source ]

The initial release of Windows Security Center in 2004, while being promoted by Microsoft as an important step forward for the visibility of security in Microsoft Windows, was criticized by a number of groups of people for various reasons. PC Magazine ran a series of articles in their Security Watch newsletter titled «Windows XP SP2 Security Center Spoofing Threat» which outlined a design vulnerability which could «potentially allow attackers to spoof the state of security on a user’s system while accessing data, infecting the system, or turning the PC into a zombie for spam or other purposes.» While the problem was made out to be trivially easy to exploit, as of 2006[ there have been no notable exploits that take advantage of Windows Security Center.