How to Check Windows Security Protection Status in Settings

Use the Windows Security app to check the status of Microsoft Defender Antivirus

What security do you have on this computer? Every Windows 11 PC ships with Windows Security. By default, that means Microsoft Defender Antivirus for malware protection and Windows Defender Firewall for network traffic. If you installed another antivirus, it normally takes over and Defender steps aside. The Windows Security app tells you which product is in charge.

The app groups everything into tiles on one dashboard. Together they give you a full overview of the protection on your PC:

• Virus & threat protection covers scans, threat history, real-time protection and ransomware protection.
• Account protection covers sign-in options such as Windows Hello and Dynamic lock.
• Firewall & network protection shows the firewall state for domain, private and public networks.
• App & browser control covers SmartScreen, exploit protection and Smart App Control.
• Device security covers hardware features such as Secure Boot and the security processor.
• Device performance & health reports on Windows Update, storage and drivers.
• Family options links to parental controls.

The quickest check is the Windows Security app. It tells you whether Microsoft Defender Antivirus is running and whether your virus definitions (the files that teach it to recognize known malware) are up to date. It needs no extra software, and it flags a problem as soon as your PC needs attention.

There is a faster way in than Settings. Press the Win, type Windows Security and press Enter. You can also click the shield icon in the system tray at the right end of the taskbar. If you don’t see it, click the small arrow to show hidden icons. Either route opens the same dashboard as the steps below.

1. Press Win+I to open Settings. The Settings⚙️ window appears. On Windows 10, go to Settings › Update & Security › Windows Security instead and skip to step 4.

2. Select Privacy & security from the left-hand menu. The privacy options fill the right-hand pane.

3. Click Windows Security. A page appears with a summary of your protection areas.

4. Click the Open Windows Security button. The Windows Security dashboard opens in its own window, with one tile for each protection area.
5. Click Virus & threat protection to see the current scan status, threat history and the active protection toggles.

That’s it. You have opened the Windows Security dashboard and can see the state of every protection area on your PC.

A green check mark on a tile means that area is fine. A yellow warning means Windows wants you to do something. A red mark means that protection is off or has failed. Click any tile marked yellow or red, and the page usually offers a button to fix the problem.

If you run a third-party antivirus, Defender usually switches itself off and the Virus & threat protection page names the other product instead. That is normal, not a fault. To see every registered security product, open the app’s own Settings (the gear icon at the bottom left) and look for the providers option.

Also check the hardware side. Click Device security on the dashboard and look at Core isolation, Memory integrity, Secure Boot and the security processor, which is the TPM (Trusted Platform Module, a chip that stores encryption keys). Memory integrity sits under the Core isolation details link. If a PC doesn’t support one of these features, the page says so. That is a hardware limit, not a fault.

Use PowerShell to check the status of Microsoft Defender Antivirus

PowerShell gives you a detailed report on Microsoft Defender Antivirus and its background services without clicking through menus. It is also handy if the Windows Security app won’t open.

1. Press the Win, type PowerShell, right-click Windows PowerShell and select Run as administrator. Click Yes if the User Account Control prompt appears. A blue PowerShell window opens.
2. Type the command Get-MpComputerStatus and press Enter. A long list of properties appears.
3. Find AntivirusEnabled, RealTimeProtectionEnabled and AntispywareEnabled in the output. Each one should show True.

That’s it. You now have a text report of Defender’s status that you can read, copy or share with a support person.

If these show False and you have another antivirus installed, that is expected, because Defender steps aside for it. If you have no other antivirus, switch real-time protection back on in Windows Security. The command only reads status and changes nothing on your PC.

Current threats

The current threats area of Windows Security lists active malware alerts, quarantine details and any files that need action from you. Windows puts suspicious items here so you can review them. You can restore files that are safe or remove dangerous ones permanently.

Scan options

Windows Security lets you run a manual scan whenever you want one. Open Virus & threat protection, then click Scan options to choose from these:

• Quick scan checks the folders where malware most often hides. It is fast and fine for a routine check.
• Full scan checks every file and running program. It can take a long time, so run it when you don’t need the PC.
• Custom scan checks only the folder or drive you pick.
• Microsoft Defender Antivirus (offline scan) restarts the PC and scans before Windows loads. It can remove stubborn malware that hides while Windows is running. Save your work first, because the PC restarts straight away.

After you choose an option, click Scan now. Windows shows progress on the same page and lists any threats it finds when the scan ends.

Allowed threats

The allowed threats section lists items that Windows flagged as malicious but that you chose to permit. Check this list now and then. Make sure no harmful software still has an exception that bypasses real-time protection.

You can find it under Current threats in Virus & threat protection. If you see something you don’t recognize, remove it from the list so Windows treats it as a threat again, then run a scan.

Virus & threat protection settings

The settings in this part control how Windows handles incoming files and possible exploits. To reach them, open Virus & threat protection and click Manage settings under Virus & threat protection settings. Changing a toggle needs an administrator account, and you may see a User Account Control prompt.

On a standard (non-administrator) account, Windows asks for an administrator password before it applies a change. If you don’t have one, ask whoever manages the PC.

Real-time protection

Real-time protection continuously monitors your file system. It scans downloads and running programs the moment they touch your machine. Keep this toggle on so new malware is caught before it can run or change system files.

If you switch it off, Windows turns it back on after a short while. That is by design. A toggle that is greyed out or turns itself off often means another antivirus is in charge or a policy is managing the setting.

Dev Drive protection

Dev Drive protection applies lighter, performance-focused scanning rules to developer volumes used for building and compiling code. It balances heavy file activity against the need for security checks.

This option only appears on recent versions of Windows 11, and it only matters if you have set up a Dev Drive. If you don’t see it, your Windows version doesn’t include it or you have no Dev Drive. You don’t need to do anything.

Cloud-delivered protection

Cloud-delivered protection sends diagnostic data to Microsoft’s cloud services, which helps identify brand-new malware almost instantly. With it on, your PC gets the latest threat intelligence gathered worldwide.

Leave this toggle on unless your organization’s policy says otherwise. If it is greyed out, another antivirus or a managed policy is probably controlling it.

Automatic sample submission

Automatic sample submission uploads suspicious files to cloud analysis servers. This helps identify unknown threats and improves protection for everyone. Windows may ask you before it sends a file, or it may send files without asking, depending on how you set it.

Tamper protection

Tamper protection stops unauthorized apps and malicious scripts from changing core security settings, turning off real-time monitoring or editing critical defense files. It keeps your security settings locked against modification.

On a new Windows 11 install it is normally on. If you can’t change it, your PC may be managed by an organization that controls the setting. If you turn it off to make a legitimate change, turn it back on afterward.

Controlled folder access

Controlled folder access protects your important folders from changes by rogue applications and ransomware. If a trusted program is blocked from saving to a protected folder, add it to the allowed apps list so it can modify those folders.

When Windows blocks an app, you usually get a notification. Use that as your cue to add the program only if you trust it.

Exclusions

The exclusions list names files, folders, file types and processes that Windows ignores during scans. Add an item here only when legitimate software triggers false positives or has performance conflicts with scanning.

Every exclusion is a blind spot, so keep the list short. To review it, open Manage settings, scroll to Exclusions and click Add or remove exclusions. Remove any entry you don’t recognize or no longer need.

Virus & threat protection updates

Security definitions need regular updates so Windows can recognize newly created malware and zero-day vulnerabilities (flaws that attackers exploit before a fix exists). You can check the date and version of your current definitions and start a download by hand. This makes sure your database matches the latest releases.

1. Open Windows Security and click Virus & threat protection.
2. Scroll to Virus & threat protection updates and click Protection updates. The page shows the version and when it was last updated.
3. Click Check for updates🔃. Windows downloads any new definitions and shows the new date when it finishes.

That’s it. Your security definitions are now current, and the page shows the date they were last refreshed.

Definitions normally arrive through Windows Update. If the check fails, make sure the PC is online and that Windows Update isn’t stuck.

Ransomware protection

Ransomware protection shields your irreplaceable files from being encrypted and held for ransom. To open it, go to Virus & threat protection and click Manage ransomware protection. It has two parts: controlled folder access and data recovery.

Controlled folder access

Controlled folder access is your main barrier here. It restricts write access to standard user folders, so only authorized applications can change your documents, pictures and desktop files while it is on.

It is off by default. Turn it on with its toggle, then check the list of protected folders and add any others you want covered. If it blocks a program you use, allow that app through the feature rather than turning the whole thing off.

Ransomware data recovery

Ransomware data recovery works with cloud storage such as OneDrive. If an encryption attack gets through, you can recover your files from the cloud. You can set up and manage the backup sync from this panel, so your data stays recoverable.

If OneDrive isn’t set up, the panel offers to set it up. It is worth doing, because a cloud copy is a backup that ransomware on your PC can’t easily reach. If you already use OneDrive, the panel shows the account and a link to manage it.

Web Protection and SmartScreen Verification

Check your web protection and SmartScreen settings so Microsoft Edge blocks malicious websites and phishing links before they load. These filters add a layer of defense against dangerous downloads and fraudulent pages.

1. Open Microsoft Edge, click the three dots in the top-right corner and select Settings.
2. Click Privacy, search, and services in the left sidebar.
3. Scroll down to the Security section and check that the toggle for Microsoft Defender SmartScreen is on.
4. Open the Windows Security app and click App & browser control. Confirm that reputation-based protection and the exploit protection settings are enabled across the operating system.
5. On the same page, find Smart App Control and click Smart App Control settings. Windows 11 shows whether it is on, in evaluation or off.

You should now know whether Edge and Windows are screening websites, downloads and apps for known threats.

Smart App Control blocks untrusted or unsigned apps. It exists only in Windows 11, so Windows 10 doesn’t show it. Which options you get, and whether you can switch it back on after turning it off, depends on your Windows 11 build.

If any of these are off, switch them back on unless you know why they were turned off. On a work PC, an administrator may have set them through policy.

Verify System Security via Registry Policies

The Windows Registry is the database where Windows stores its settings. The key below mainly controls notifications and the look of the Windows Security app. It does not show whether protection is on or off, so use the earlier sections for that. Checking it is only useful to confirm that nothing has changed how the app behaves.

1. Press Win+R to open the Run dialog box.
2. Type regedit and press Enter to open the Registry Editor. Click Yes at the User Account Control prompt. The editor opens with a folder tree on the left.
3. Navigate to the following location by expanding each folder in the tree:
   🗝️HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Settingscopy
4. Look at the DWORD values (numeric settings) in the right-hand pane. They show any custom configuration applied to your security dashboard notifications and options.

You should now know whether anything customizes how the Windows Security app behaves on this PC.

If the key doesn’t exist, nothing is overriding those settings at that location, and that is normal on many PCs. If you do edit a value, first export the key with File › Export so you can undo the change by opening the saved file.

If this didn’t work

If the security dashboard keeps showing errors or wrong statuses, corrupted system files may be the cause. The System File Checker tool scans protected system files and replaces damaged ones, which can restore the security app to normal.

Running sfc /scannow needs an administrator account. Press the Win, type cmd, right-click Command Prompt and select Run as administrator. Then run the command in the next block.

sfc /scannow

That command scans for corrupted system files and replaces them automatically. Follow these steps when it runs:

1. Wait until the scan reaches 100 percent and reports its result. Don’t close the window early, because the scan can take several minutes.
2. Restart your🔄 computer.
3. Open the Windows Security app again and confirm that the protection statuses now display correctly.

That’s it. Any damaged system files the tool could repair are fixed, and the Windows Security dashboard should now report accurate statuses.

If the tool reports that it found corrupt files it could not repair, or the errors come back after the restart, the system image itself may need repair. In that case, DISM /Online /Cleanup-Image /RestoreHealth is often run first, from the same administrator Command Prompt. Run the System File Checker again once DISM finishes.