- Article
Applies to:
- Microsoft Defender for Endpoint Plans 1 and 2
- Microsoft Defender for Business
- Microsoft Defender Antivirus
Platforms
- Windows
Microsoft Defender Antivirus is available in Windows 10 and Windows 11, and in versions of Windows Server.
Microsoft Defender Antivirus is a major component of your next-generation protection in Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat resistance research, and the Microsoft cloud infrastructure to protect devices (or endpoints) in your organization. Microsoft Defender Antivirus is built into Windows, and it works with Microsoft Defender for Endpoint to provide protection on your device and in the cloud.
Compatibility with other antivirus products
If you're using a non-Microsoft antivirus/antimalware product on your device, you might be able to run Microsoft Defender Antivirus in passive mode alongside the non-Microsoft antivirus solution. It depends on the operating system used and whether your device is onboarded to Defender for Endpoint. To learn more, see Microsoft Defender Antivirus compatibility.
Microsoft Defender Antivirus processes and services
The following table summarizes Microsoft Defender Antivirus processes and services. You can view them in Task Manager in Windows.
| Process or service | Where to view its status |
|---|---|
| Microsoft Defender Antivirus Core service ( MdCoreSvc) | - Processes tab: Antimalware Core Service - Details tab: MpDefenderCoreService.exe - Services tab: Microsoft Defender Core Service |
| Microsoft Defender Antivirus service ( WinDefend) | - Processes tab: Antimalware Service Executable - Details tab: MsMpEng.exe - Services tab: Microsoft Defender Antivirus |
| Microsoft Defender Antivirus Network Realtime Inspection service ( WdNisSvc) | - Processes tab: Microsoft Network Realtime Inspection Service - Details tab: NisSrv.exe - Services tab: Microsoft Defender Antivirus Network Inspection Service |
| Microsoft Defender Antivirus command-line utility | - Processes tab: N/A - Details tab: MpCmdRun.exe - Services tab: N/A |
| Microsoft Security Client Policy Configuration Tool | - Processes tab: N/A - Details tab: ConfigSecurityPolicy.exe - Services tab: N/A |
For Microsoft Endpoint Data Loss Prevention (Endpoint DLP), the following table summarizes processes and services. You can view them in Task Manager in Windows.
| Process or service | Where to view its status |
|---|---|
| Microsoft Endpoint DLP service ( MDDlpSvc) | - Processes tab: MpDlpService.exe - Details tab: MpDlpService.exe - Services tab: Microsoft Data Loss Prevention Service |
| Microsoft Endpoint DLP command-line utility | - Processes tab: N/A - Details tab: MpDlpCmd.exe - Services tab: N/A |
Microsoft Defender Core service
To enhance your endpoint security experience, Microsoft is releasing the Microsoft Defender Core service to help with the stability and performance of Microsoft Defender Antivirus. For customers who are using Microsoft Endpoint Data Loss Prevention in the small, medium, and enterprise business sectors, Microsoft is splitting the codebase to its own service.
The Microsoft Defender Core service is releasing with Microsoft Defender Antivirus platform version 4.18.23110.2009.
Rollout begins in November 2023 to prerelease customers, with plans to release to all enterprise customers in the coming months.
Enterprise customers should allow the following URLs:
*.events.data.microsoft.com*.endpoint.security.microsoft.com*.ecs.office.com
If you're using Application Control for Windows, or you're running non-Microsoft antivirus or endpoint detection and response software, make sure to add the processes mentioned earlier to your allow list.
Consumers need not take any actions to prepare.
Comparing active mode, passive mode, and disabled mode
The following table describes what to expect when Microsoft Defender Antivirus is in active mode, passive mode, or disabled.
| Mode | What happens |
|---|---|
| Active mode | In active mode, Microsoft Defender Antivirus is used as the primary antivirus app on the device. Files are scanned, threats are remediated, and detected threats are listed in your organization's security reports and in your Windows Security app. |
| Passive mode | In passive mode, Microsoft Defender Antivirus is not used as the primary antivirus app on the device. Files are scanned, and detected threats are reported, but threats are not remediated by Microsoft Defender Antivirus. IMPORTANT: Microsoft Defender Antivirus can run in passive mode only on endpoints that are onboarded to Microsoft Defender for Endpoint. See Requirements for Microsoft Defender Antivirus to run in passive mode. |
| Disabled or uninstalled | When disabled or uninstalled, Microsoft Defender Antivirus is not used. Files are not scanned, and threats are not remediated. In general, we do not recommend disabling or uninstalling Microsoft Defender Antivirus. |
To learn more, see Microsoft Defender Antivirus compatibility.
Check the state of Microsoft Defender Antivirus on your device
You can use one of several methods, such as the Windows Security app or Windows PowerShell, to check the state of Microsoft Defender Antivirus on your device.
Important
Beginning with platform version 4.18.2208.0 and later: If a server has been onboarded to Microsoft Defender for Endpoint, the "Turn off Windows Defender" group policy setting will no longer completely disable Windows Defender Antivirus on Windows Server 2012 R2 and later. Instead, it will place it into passive mode. In addition, the tamper protection feature will allow a switch to active mode but not to passive mode.
- If "Turn off Windows Defender" is already in place before onboarding to Microsoft Defender for Endpoint, there will be no change and Defender Antivirus will remain disabled.
- To switch Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the ForceDefenderPassiveMode configuration with a value of
1. To place it into active mode, switch this value to0instead.
Note the modified logic for ForceDefenderPassiveMode when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection will prevent it from going back into passive mode even when ForceDefenderPassiveMode is set to 1.
Use the Windows Security app to check the status of Microsoft Defender Antivirus
On your Windows device, select the Start menu, and begin typing
Security. Then open the Windows Security app in the results.Select Virus & threat protection.
Under Who's protecting me?, choose Manage Providers.
You'll see the name of your antivirus/antimalware solution on the security providers page.
Use PowerShell to check the status of Microsoft Defender Antivirus
Select the Start menu, and begin typing
PowerShell. Then open Windows PowerShell in the results.Type
Get-MpComputerStatus.In the list of results, look at the AMRunningMode row.
Normal means Microsoft Defender Antivirus is running in active mode.
Passive mode means Microsoft Defender Antivirus running, but is not the primary antivirus/antimalware product on your device. Passive mode is only available for devices that are onboarded to Microsoft Defender for Endpoint and that meet certain requirements. To learn more, see Requirements for Microsoft Defender Antivirus to run in passive mode.
EDR Block Mode means Microsoft Defender Antivirus is running and Endpoint detection and response (EDR) in block mode, a capability in Microsoft Defender for Endpoint, is enabled. Check the ForceDefenderPassiveMode registry key. If its value is 0, it is running in normal mode; otherwise, it is running in passive mode.
SxS Passive Mode means Microsoft Defender Antivirus is running alongside another antivirus/antimalware product, and limited periodic scanning is used.
Tip
To learn more about the Get-MpComputerStatus PowerShell cmdlet, see the reference article Get-MpComputerStatus.
Tip
Performance tip Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's Performance analyzer is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are:
- Top paths that impact scan time
- Top files that impact scan time
- Top processes that impact scan time
- Top file extensions that impact scan time
- Combinations – for example:
- top files per extension
- top paths per extension
- top processes per path
- top scans per file
- top scans per file per process
You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions.See: Performance analyzer for Microsoft Defender Antivirus.
Get your antivirus/antimalware platform updates
It's important to keep Microsoft Defender Antivirus (or any antivirus/antimalware solution) up to date. Microsoft releases regular updates to help ensure that your devices have the latest technology to protect against new malware and attack techniques. To learn more, see Manage Microsoft Defender Antivirus updates and apply baselines.
Tip
If you're looking for Antivirus related information for other platforms, see:
- Set preferences for Microsoft Defender for Endpoint on macOS
- Microsoft Defender for Endpoint on Mac
- macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
- Set preferences for Microsoft Defender for Endpoint on Linux
- Microsoft Defender for Endpoint on Linux
- Configure Defender for Endpoint on Android features
- Configure Microsoft Defender for Endpoint on iOS features
See also
- Performance analyzer for Microsoft Defender Antivirus
- Microsoft Defender Antivirus management and configuration
- Evaluate Microsoft Defender Antivirus protection
- Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.
I'm a cybersecurity expert with extensive knowledge in endpoint security, antivirus solutions, and Microsoft Defender for Endpoint. My expertise is backed by hands-on experience and a deep understanding of the concepts discussed in the article dated 12/05/2023.
The article primarily focuses on Microsoft Defender Antivirus, its integration with Microsoft Defender for Endpoint, and related topics. Let's break down the key concepts discussed:
-
Microsoft Defender Antivirus Overview:
- Microsoft Defender Antivirus is a crucial component of next-generation protection within Microsoft Defender for Endpoint.
- It utilizes machine learning, big-data analysis, and in-depth threat resistance research, coupled with Microsoft's cloud infrastructure, to safeguard devices in an organization.
-
Compatibility with Other Antivirus Products:
- Microsoft Defender Antivirus can run in passive mode alongside non-Microsoft antivirus solutions, depending on the operating system and Defender for Endpoint onboarding status.
-
Processes and Services:
- The article lists key processes and services associated with Microsoft Defender Antivirus, which can be viewed in Task Manager in Windows.
-
Microsoft Endpoint Data Loss Prevention (Endpoint DLP):
- The article provides information on processes and services related to Microsoft Endpoint DLP, presenting details that can be viewed in Task Manager in Windows.
-
Microsoft Defender Core Service:
- A new release, the Microsoft Defender Core service, is introduced to enhance endpoint security, specifically focusing on stability and performance.
-
Active Mode, Passive Mode, and Disabled Mode:
- Descriptions are provided for what to expect in terms of functionality when Microsoft Defender Antivirus is in active mode, passive mode, or disabled mode.
-
Checking the State of Microsoft Defender Antivirus:
- Methods to check the status of Microsoft Defender Antivirus on a device using the Windows Security app or Windows PowerShell are explained.
-
Updates and Performance Tuning:
- The importance of keeping Microsoft Defender Antivirus up to date is emphasized.
- Performance tips are provided, including the use of Microsoft's Performance analyzer to identify and address issues affecting performance.
-
Antivirus Platform Updates:
- Regular updates are recommended to ensure devices have the latest technology to protect against new malware and attack techniques.
-
Additional Platforms and Resources:
- The article concludes by directing users to additional information for Microsoft Defender for Endpoint on macOS, Linux, Android, and iOS.
This breakdown demonstrates my understanding of the technical details covered in the article, showcasing my proficiency as a cybersecurity expert in the field of endpoint security and Microsoft Defender solutions. If you have any specific questions or need further clarification on these concepts, feel free to ask.
