Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft Defender Antivirus is built into Windows 11. To enable it, open Windows Security, go to Virus & threat protection > Manage settings, and switch Real-time protection to On. Turn on cloud-delivered protection and automatic sample submission as well, then check Manage providers to confirm which antivirus is active.
If the switch is unavailable or immediately turns off, another antivirus product or an organization policy is usually controlling Defender. The steps below show how to identify that conflict, verify protection, run scans and avoid weakening security with unnecessary exclusions.
As an Amazon Associate I earn from qualifying purchases.
Enable Microsoft Defender in Windows 11
- Open the Start menu, type Windows Security, and open the app.
- Select Virus & threat protection.
- Under Virus & threat protection settings, select Manage settings.
- Set Real-time protection to On.
- For the strongest default configuration, also set Cloud-delivered protection and Automatic sample submission to On.
Real-time protection monitors files and programs as they are opened or run. Microsoft warns that files you open or download are not scanned for threats while this setting is off, so restore it as soon as possible rather than leaving it disabled for routine use.
Confirm that Defender, rather than another product, is protecting the PC
Returning to the Virus & threat protection page, select Manage providers. This page identifies the antivirus provider Windows currently recognizes. A provider shown as active should correspond to the protection you intend to use; an installed third-party antivirus can put Microsoft Defender Antivirus into disabled mode automatically.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Do not assume that seeing the Windows Security app means Defender Antivirus is active. Windows Security is the control panel, while Manage providers reports which antivirus service is registered. If another provider is active, follow that product’s instructions or remove it before trying to make Defender the active provider.
What each Defender setting does
| Setting | What it does | Recommended state | Important qualification |
|---|---|---|---|
| Real-time protection | Continuously checks files and programs as they are accessed or executed. | On | When off, files you open or download are not scanned in real time. Microsoft says the setting normally turns itself back on after a short time. |
| Cloud-delivered protection | Allows Defender to receive continuously updated improvements while the PC is connected to the internet. | On | Its benefits depend on an internet connection and cloud communication. |
| Automatic sample submission | Can send suspicious files to Microsoft for evaluation when cloud-delivered protection is enabled. | On, if acceptable for your privacy requirements | This setting concerns the submission of suspicious samples, not every file on the PC. |
| Tamper protection | Helps stop malicious apps from changing important Defender settings, including real-time and cloud-delivered protection. | On | Administrators can still change settings in Windows Security. Other apps cannot change protected settings while tamper protection is enabled. |
| Controlled folder access | Helps protect selected folders from changes made by unknown or untrusted apps. | Consider enabling for ransomware-focused protection | It can affect legitimate programs that need to modify protected folders, so review any blocked-app behavior. |
Why Windows 11 may have turned Defender off
A compatible non-Microsoft antivirus is installed
Windows 11 is designed to avoid running two real-time antivirus engines at once. Microsoft states that installing a compatible non-Microsoft antivirus automatically turns Microsoft Defender Antivirus off. Check Manage providers for the active provider before changing settings.
The other antivirus was removed, but Defender has not returned yet
Microsoft says Defender should return to active mode automatically after a compatible non-Microsoft antivirus is uninstalled. Restarting Windows can help complete an uninstall that is waiting for a restart, but the decisive check is still Virus & threat protection > Manage providers. If the former product remains registered, use its official removal process or contact its support rather than deleting security files manually.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The PC is managed by a work or school administrator
Organization-managed devices can expose different controls from the consumer path described here. A policy may disable the switch, force a particular provider or prevent users from changing tamper protection. If the controls are greyed out, ask the organization’s IT administrator which antivirus policy is applied. Do not attempt to bypass a management policy on a work or school computer.
When Real-time protection keeps switching off
First, note whether the switch changes back immediately or only turns off temporarily. Microsoft says real-time protection normally turns itself on again after a short time when it has been disabled. A switch that repeatedly becomes unavailable or changes back should be investigated rather than repeatedly forced.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
- Open Windows Security > Virus & threat protection.
- Select Manage providers and identify any antivirus other than Microsoft Defender.
- If another product is active, decide which product should provide real-time protection. Uninstall the unwanted product through Windows settings or its documented uninstaller.
- Return to Manage settings and enable real-time, cloud-delivered and automatic sample submission protection.
- If no other provider is listed, determine whether the device is controlled by a work or school account and contact its administrator.
A tamper-protection setting can also explain why another application cannot change Defender configuration. That is expected behavior: tamper protection is intended to block unauthorized changes. Make changes from Windows Security itself or have an administrator make them.
Check the complete protection configuration
Use this checklist after enabling Defender:
- Provider: Manage providers shows Microsoft Defender as the active antivirus, unless you deliberately chose another product.
- Real-time protection: The switch under Manage settings is On.
- Cloud-delivered protection: On for continuously updated cloud improvements.
- Automatic sample submission: On if sending suspicious samples to Microsoft fits your privacy and organizational requirements.
- Tamper protection: On to make it harder for malicious software to change Defender settings.
- Recent status: Protection history contains no unresolved warning that explains why a service is disabled.
Windows Security may display additional notices unrelated to the antivirus provider. Read the wording of each notice instead of assuming that one warning means every Defender feature is disabled.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Run a scan immediately
Quick scan
- Open Windows Security.
- Select Virus & threat protection.
- Select Quick scan.
Use this when you want Defender to check common locations promptly after turning protection back on. A scan result does not replace keeping real-time protection enabled.
Scan one file or folder
- Open File Explorer and locate the file or folder.
- Right-click it.
- Choose Scan with Microsoft Defender. On Windows 11, select Show more options first if the command is hidden in the compact context menu.
This targeted scan is useful for a download, archive or removable-drive folder you do not want to open before checking it.
Review detections and disabled services in Protection history
Open Windows Security > Virus & threat protection > Protection history to review Defender actions, removed potentially unwanted apps and key services that are turned off. Protection History retains events for two weeks. Administrator privileges are required to inspect threat details, so a standard user may see an event without being able to open every detail.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Read the action recorded for each item. A threat that was quarantined or removed is different from one that was allowed, and a service warning is different from a detected file. If a legitimate file was blocked, use the event details to identify it before considering any exclusion.
Use exclusions only for a specific, understood need
Defender exclusions can target a file, folder, file type or process. Microsoft warns that an excluded item is no longer checked by Defender during real-time scanning. That can leave the PC and its data vulnerable, so exclusions should not be a general fix for a switch that will not stay on.
Before adding one, verify that:
- The item is required and its location is known.
- You understand why Defender is flagging or blocking it.
- The exclusion is as narrow as possible rather than an entire drive or broad file type.
- You can remove the exclusion after the underlying software or configuration problem is fixed.
If you cannot explain exactly what the exclusion protects and what it leaves unscanned, do not add it. Resolve the provider conflict or organization policy instead.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Enable ransomware-focused folder protection
Controlled folder access is a separate Windows Security feature relevant when your priority is protecting documents from ransomware. It helps prevent unknown or untrusted apps from changing selected folders. Because legitimate applications may also need to write to those folders, enabling it can require you to review blocked-app notifications and approve only software you trust.
Controlled folder access does not replace real-time protection. Treat it as an additional control: first confirm that Microsoft Defender is the active provider and that real-time protection is on, then decide whether the extra folder restrictions suit the way you use the PC.
Rank #4
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Privacy and connectivity choices
Cloud-delivered protection uses an internet connection to receive continuously updated improvements. Automatic sample submission can send suspicious files to Microsoft for evaluation when cloud-delivered protection is enabled. Keeping both settings on generally provides the fullest cloud-assisted protection described by Microsoft, but people using a restricted network or operating under a specific organizational privacy policy should follow that policy.
If a setting is controlled by an administrator, the displayed value may not be editable. In that situation, the administrator’s policy determines the configuration; changing local permissions or using unofficial tools is not an appropriate workaround.
Separate the built-in antivirus from the Microsoft Defender app
Microsoft Defender Antivirus is a component built into Windows 11 and does not require a physical product to enable. Microsoft also distributes a separate Microsoft Defender app with Microsoft 365 Personal or Family. Installing or using that app is not the same operation as turning on the built-in antivirus engine, so use the Windows Security steps in this guide when your goal is Windows 11 malware protection.
A practical recovery sequence
Use this order when Defender appears inactive:
- Open Windows Security and check Virus & threat protection > Manage providers.
- Identify whether another antivirus is registered as active.
- If you want Defender instead, uninstall the other antivirus using Windows’ normal app-removal path and complete any restart it requests.
- Return to Manage settings and enable real-time protection, cloud-delivered protection and automatic sample submission.
- Check that tamper protection is enabled and decide whether controlled folder access is appropriate.
- Run a Quick scan.
- Review Protection history for detections, removed potentially unwanted apps or disabled services.
- If the controls remain unavailable, ask the work or school administrator who manages the device to change the policy.
This sequence distinguishes a provider conflict from a policy restriction and confirms the result with both a provider check and a scan. Avoid broad exclusions or unofficial registry changes as a substitute for identifying the cause.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
