Is Windows Defender Enough? Home Settings Guide

Every Windows 10 and Windows 11 PC already has an antivirus, Microsoft Defender Antivirus, yet many people either pay for a second product they do not need or leave the free one running with its most useful protections switched off. This guide answers the question home users search for most, "is Windows Defender enough?", and then shows exactly which settings in the Windows Security app to check: real-time and cloud protection, tamper protection, ransomware protection, exclusions and the offline scan. It is written for home users, families and very small offices, and for the relative who looks after everyone's PCs. Businesses that manage many devices should read the Microsoft Defender for Endpoint Guide instead. Setting names are taken from Microsoft's support pages, checked on 8 November 2026.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

For most home users, built-in protection is enough when it is set up properly. The UK NCSC notes that Windows ships with Defender Antivirus and SmartScreen, and advises against running more than one antivirus at once.
Keep tamper protection on. It stops malicious apps changing key settings such as real-time and cloud-delivered protection.
Turn on ransomware protection deliberately. Controlled folder access is not something to assume; check it under Manage ransomware protection and pair it with a OneDrive or other backup.
Treat exclusions as holes. Microsoft warns that an exclusion means Defender stops checking those files; never add one because a website or pop-up told you to.
Use the offline scan when something feels wrong. It restarts the PC and scans before Windows fully loads, which makes it harder for persistent malware to hide.

Is Microsoft Defender Antivirus enough?

Microsoft Defender Antivirus is the antivirus engine inside the Windows Security app. It is on by default unless another antivirus is installed: Microsoft's documentation says that on a home PC, Defender switches itself off automatically when a compatible non-Microsoft antivirus registers as the main protection, and switches back on when that product expires, is removed or stops protecting. The NCSC's device security guidance makes the same practical point from the other side: Windows already includes antivirus and SmartScreen, and running two antivirus products together is not advised.

Whether you need anything more depends on what you want beyond malware scanning:

Need	Built-in Windows Security	What a paid suite or subscription may add
Malware scanning and real-time protection on Windows	Yes: Defender Antivirus with cloud-delivered protection	Another engine; independent labs such as AV-TEST and AV-Comparatives test both
Ransomware protection for your folders	Yes: Controlled folder access, plus Ransomware data recovery with OneDrive	Similar folder shields or backup bundles
Blocking dangerous sites and downloads	Yes: SmartScreen in Microsoft Edge and Windows	Browser extensions covering other browsers
Protection for phones, Macs and family devices in one view	No: Windows Security covers that one PC	Multi-device apps; Microsoft's own Microsoft Defender app is included with Microsoft 365 Personal and Family
Firewall	Yes: Windows Defender Firewall, on by default	Alternative firewalls (rarely needed at home)
VPN, password manager, identity monitoring	No	Often bundled; judge each on its own merits

Do not confuse the two Defenders. Microsoft Defender Antivirus is built into Windows and free. The Microsoft Defender app is a separate app for individuals and families, included with Microsoft 365 Family and Personal, that runs on Windows, Mac, Android and iOS, shows the security status of up to five devices per person, and adds web protection on phones. On Windows it works alongside the built-in antivirus rather than replacing it. For a structured way to compare paid products, see the Home Antivirus and Security Suite Buyer's Guide.

Who can change the settings: admin accounts and tamper protection

Antivirus settings are only as safe as the account that can change them.

Use a standard account day to day: anyone signed in as an administrator can switch protections off, and so can malware running as that person. Keep one administrator account for installing software and give family members standard accounts. See the Windows 11 Security Settings Guide for how to change account types.
Tamper protection: found under Virus & threat protection > Manage settings (shortcut windowsdefender://threatsettings/). Microsoft says it is designed to stop malicious apps changing important settings such as real-time protection and cloud-delivered protection. An administrator can still change those settings in Windows Security, but other apps cannot. With tamper protection on, you must turn it off before you can turn off real-time protection, which is itself a useful speed bump.
Real-time protection comes back on its own: Microsoft says that if you switch it off it turns back on automatically after a short time, and scheduled scans keep running.
"Your organisation manages this setting": on a personal PC this message is a warning sign. It can appear after a work tool was installed, but malware also changes policy settings to disable protection. If you have no work software on the PC, run an offline scan.

Connected protections: cloud, samples, SmartScreen and other apps

Defender works best when its online parts are switched on. These live under Virus & threat protection settings:

Setting	What it does (per Microsoft)	Recommended at home
Real-time protection	Monitors files and programs as they are opened or run	On
Cloud-delivered protection	Lets Defender receive ongoing improvements from Microsoft while online	On
Automatic sample submission	Sends suspicious files to Microsoft for analysis; "Submit a sample manually" sends one file	On, unless you handle very sensitive documents and prefer manual submission
Tamper protection	Blocks other apps from changing key Defender settings	On
Controlled folder access	Blocks untrusted apps from changing files in protected folders	On, after a short trial (see below)
Exclusions	Skips real-time scanning for a file, folder, file type or process	Empty, or as few as possible
Dev Drive protection	Performance mode for Dev Drive volumes (Windows 11 only)	Leave at default unless you develop software

Two related protections sit in App & browser control rather than the antivirus page. Reputation-based protection includes SmartScreen checks for apps, files and websites and blocking of potentially unwanted apps, the bundled adware and "PC optimiser" tools that are not quite malware. Smart App Control, available on Windows 11, blocks untrusted or unsigned apps outright. See the Smart App Control and SmartScreen guide.

If you install another antivirus, Defender steps aside automatically. Microsoft notes that tamper protection does not affect how third-party antivirus apps register with Windows Security, and that Defender exclusions do not stop a third-party product from scanning those files.

Ransomware protection

Open Virus & threat protection > Manage ransomware protection. There are two parts:

Controlled folder access: blocks unknown or untrusted apps from changing files in protected folders. By default these are Documents, Pictures, Videos, Music and Desktop. Add other folders with Protected folders.
Ransomware data recovery: works with OneDrive, so that if ransomware affects your files Windows Security can guide you through restoring them from OneDrive. It also notifies you if there is a problem with your OneDrive backup.

Controlled folder access sometimes blocks a legitimate program, such as an older photo editor or a game saving to Documents. When that happens you see an "App is blocked" notice. Microsoft's advice is to note the app's path, select the message, choose Add an allowed app and browse to that program, and to add only apps you trust, because any allowed app can change the protected files. Never allow an app you do not recognise just to make a notice go away.

Folder protection is not a backup. Keep a copy of important files somewhere ransomware on the PC cannot overwrite, such as OneDrive with version history or an external drive you disconnect after each backup.

Scans, alerts and protection history

The Scan options page offers four scans:

Scan	What it checks	When to use it
Quick scan	A subset of files and folders where threats usually hide	Any time; it is fast
Full scan	Every file and program on the device	After a detection, after plugging in an unknown drive, or monthly
Custom scan	Only the files and folders you choose	Checking one download folder or USB stick
Microsoft Defender Antivirus (offline scan)	Restarts and scans before Windows fully loads	Suspected infection, protection that keeps switching off, or pop-ups you cannot explain

Before an offline scan, save your work and close everything: Microsoft says it takes several minutes, restarts the PC, and then removes or quarantines what it finds. Results appear in Protection history, which also lists past detections, quarantined items and blocked folder access. The Allowed threats list shows anything you chose to let run; choose Don't allow on anything you do not remember allowing.

For the family IT helper: the event log

Defender writes to Event Viewer under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. The events worth knowing, as named in Microsoft's documentation:

Event ID	Meaning	What it tells you
1116	Malware or potentially unwanted software detected	A detection happened; check the file path
1117	Action taken to protect the system	Usually fine: the threat was quarantined or removed
1118 / 1119	Action failed / critically failed	Microsoft warns after 1119 that the device might not be protected: run an offline scan
5001	Real-time protection is disabled	Expected only if you or another antivirus turned it off
5007	Configuration changed	Microsoft says an unexpected 5007 might be the result of malware: review settings and exclusions
2001 / 2003	Security intelligence / engine update failed	Protection is going stale: check Windows Update and connectivity

Simple measures that show protection is working on a household's PCs: real-time and tamper protection on for every PC, security intelligence updated within the last day (shown under Protection updates, or use Check for updates), zero unexplained exclusions, zero unexplained 5001 or 5007 events, and a tested restore from backup in the last six months.

Hardening baseline: a 15-minute setup

Update Windows first. Security intelligence arrives through Windows Update; open Windows Security > Virus & threat protection > Protection updates and select Check for updates.
Check there is one antivirus only. If an old trial antivirus is still installed but expired, uninstall it fully so Defender can take over.
Turn on the core four under Manage settings: Real-time protection, Cloud-delivered protection, Automatic sample submission and Tamper protection.
Review exclusions under Add or remove exclusions and remove anything you cannot explain.
Trial controlled folder access. Turn it on, use the PC normally for a week, and allow only the trusted apps it blocks. If something important breaks and you cannot work out why, turn it off again while you investigate: that is the rollback.
Set up backup. Turn on OneDrive folder backup or another backup, so Ransomware data recovery and your own restores have something to work with.
Turn on reputation-based protection in App & browser control, including potentially unwanted app blocking.
Run a full scan once, and check Protection history for anything left over.
Make everyday accounts standard users, keeping one administrator account.

Where identity fits

A lot of modern malware is not trying to break your PC at all: it steals saved browser passwords and session cookies so criminals can sign in to your accounts. Defender helps by blocking known infostealers, but if it ever reports one, assume your saved passwords are exposed. After cleaning the PC, change the passwords for your email and Microsoft account first, sign out of other sessions, and turn on two-step verification or passkeys. The Microsoft Account Security Guide walks through that for a Microsoft account, and the Infostealer Threat Guide explains how these thefts work.

Common misconfigurations

Two antivirus products fighting: an expired trial left installed can keep Defender switched off while protecting nothing. Remove it.
Exclusions added on instructions from a stranger: "add this folder to exclusions so the game works" is a classic way to get malware past Defender. Microsoft's own warning is that excluded files are no longer checked.
Whole-drive or Downloads folder exclusions: often added to speed things up, they leave the riskiest places unscanned. If performance is the issue, exclude one specific file or folder at most.
Allowing any app that controlled folder access blocks: the block may be the ransomware. Check the path before allowing.
Believing pop-ups that claim to be Defender: real Defender alerts appear as Windows notifications and in Windows Security, never as a web page with a phone number. See the Recognising Tech Support Scams Guide.
Folder protection without backups: controlled folder access reduces risk but does not bring files back. Keep a backup.

How this maps to recognised guidance

Home setting	Threat	Framework reference
Real-time, cloud-delivered protection and scans	Malicious downloads and files	NIST SP 800-53 SI-3 Malicious Code Protection; NIST CSF 2.0 DE.CM-09
Tamper protection, standard user accounts	Malware switching protection off (ATT&CK T1685 Disable or Modify Tools)	NIST SP 800-53 CM-6; AC-6
Controlled folder access and backups	Ransomware (ATT&CK T1486 Data Encrypted for Impact)	NIST CSF 2.0 PR.DS-11
Smart App Control and unwanted app blocking	Untrusted software running	NIST CSF 2.0 PR.PS-05

Practitioner checklist

Confirm only one antivirus is active and Windows Security shows no warnings.
Real-time, cloud-delivered protection, automatic sample submission and tamper protection all on.
Security intelligence updated within the last day.
Exclusions list empty or fully explained.
Controlled folder access on, with only trusted apps allowed.
OneDrive or other backup running, with a restore tested.
Reputation-based protection and potentially unwanted app blocking on.
Everyday accounts are standard users.
Offline scan run after any detection or unexplained change in settings.
Protection history and Allowed threats reviewed monthly.

Microsoft Defender Antivirus for Home Users Guide: Settings That Make Built-In Protection Enough