The Windows Security App: Scans, Real-Time Protection, Tamper Protection and Ransomware Protection
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of Microsoft Support's "Stay protected with the Windows Security app" and "Virus and threat protection in the Windows Security app" pages (linked below), checked October 29, 2026. Menu names can differ slightly between Windows versions. This is general information, not security certification advice.
Every Windows 11 and Windows 10 PC already has antivirus. It's called Microsoft Defender Antivirus, and you manage it from the Windows Security app, along with the firewall and other protections. Microsoft says it's built in, so the device is protected from the moment you start it. Most home offices never open the app. Here's what's in it and the few settings worth checking.
To open it, search for Windows Security in the Start menu, then choose Virus & threat protection.
Run a scan
Windows Security scans automatically, but you can run one any time. Microsoft lists four kinds:
| Scan | What it does | When to use it |
|---|---|---|
| Quick scan | A faster check, for when you don't want to wait for a full scan | First step if you suspect a problem; Microsoft says to run one immediately |
| Full scan | Every file and program on the device | If a quick scan finds nothing but you're still worried |
| Custom scan | Only the files and folders you choose | A download or USB drive you're unsure about |
| Microsoft Defender Antivirus (offline scan) | Restarts the PC and scans without loading Windows, so persistent malware has a harder time hiding | When you think the PC was exposed to malware; save your work first, because it restarts |
You can also right-click a file or folder in File Explorer and choose Scan with Microsoft Defender. On Windows 11 you may need to pick Show more options first. Offline scan results appear under Protection history.
Under Current threats you'll see anything found, when the last scan ran, how long it took, and items that were quarantined. There's also an Allowed threats list: things you told Windows to ignore. If you allowed something by mistake, select it and choose Don't allow.
Settings worth checking
Go to Virus & threat protection > Manage settings.
Real-time protection continuously checks files and programs as they're opened or run. You can switch it off briefly, but Microsoft notes it turns itself back on after a short while, and while it's off, files you open or download aren't scanned. If you only need one file or folder left alone, Microsoft says an exclusion is safer than turning protection off.
Cloud-delivered protection lets Defender get constantly updated improvements from Microsoft while you're online, for more accurate detection. Automatic sample submission can send suspicious files to Microsoft; Microsoft says it will alert you if a requested file contains personal information so you can decide.
Tamper protection stops malicious apps from changing important Defender settings, such as real-time and cloud-delivered protection. As an administrator you can still change them in the app; other apps can't. If it's on, you'll need to turn it off before you can turn off real-time protection, which is a good reason to leave it on.
If you install another antivirus, Microsoft says Defender Antivirus turns itself off automatically.
Exclusions: use sparingly
Exclusions stop real-time scanning of a file, folder, file type or process. Microsoft's caution is direct: an exclusion means Defender no longer checks those items, which could leave your device vulnerable. If you must add one, Microsoft recommends using the full path and file name for a process, so malware can't hide behind the same name. Scheduled scans may still check excluded items.
Keep security intelligence up to date
"Security intelligence" (also called definitions) describes the latest threats. Windows downloads it automatically through Windows Update, but you can check manually under Virus & threat protection > Protection updates > Check for updates. That's one more reason to keep Windows itself supported; see Windows 10 end of support options.
Ransomware protection
Under Virus & threat protection > Manage ransomware protection there are two parts.
Controlled folder access blocks unknown or untrusted apps from changing files in protected folders. Microsoft says it protects common folders such as Documents, Pictures, Videos, Music and Desktop by default, and you can add more. If it blocks an app you trust, Windows shows a notification; you can add it as an allowed app. Microsoft's caution: any allowed app can change those files, so if that app is compromised, your data could be at risk.
If you try to save a file and the folder is blocked, Microsoft says the app you're using is the thing being blocked. Save to another location, allow the app, then save where you wanted.
Ransomware data recovery works with OneDrive: back up important files there, and if ransomware strikes, Windows Security can guide you through restoring them. Whatever tool you use, an independent copy matters; see our 3-2-1 backup guide.
A five-minute check for a home office PC
- Open Windows Security and confirm there are no warnings on the home page.
- Real-time, cloud-delivered and tamper protection are on.
- Review Allowed threats and Exclusions; remove anything you don't recognize.
- Check for protection updates.
- Decide whether to turn on Controlled folder access.
- Turn on drive encryption, too: BitLocker and FileVault.
And if a pop-up or caller says your PC is infected and you must call a number or pay, that isn't Windows Security; see tech support scams.