Microsoft Defender Antivirus (formerly Windows Defender) is an
anti-malware
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the name. ...
component of
Microsoft Windows. It was first released as a downloadable free anti-spyware program for
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
and was shipped with
Windows Vista
Windows Vista is a major release of the Windows NT operating system developed by Microsoft. It was the direct successor to Windows XP, which was released five years before, at the time being the longest time span between successive releases of ...
and
Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...
. It has evolved into a full antivirus program, replacing
Microsoft Security Essentials
Microsoft Security Essentials (MSE) is an antivirus software (AV) product that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and Trojan horses. Prior to version 4.5, MSE ran on , ...
in
Windows 8
Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on August 1, 2012; it was subsequently made available for download via MSDN and TechNet on August 15, 2012, and later to ...
or later versions.
In March 2019, Microsoft announced Microsoft Defender ATP for Mac for business customers to protect their
Mac devices from attacks on a corporate network, and a year later, to expand protection for mobile devices, it announced Microsoft Defender ATP for
Android and
iOS
iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that powers many of the company's mobile devices, including the iPhone; the term also include ...
devices, which incorporates
Microsoft SmartScreen
SmartScreen (officially called Windows SmartScreen, Windows Defender SmartScreen and SmartScreen Filter in different places) is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating syst ...
, a
firewall
Firewall may refer to:
* Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts
* Firewall (construction), a barrier inside a building, designed to limit the spr ...
, and
malware scanning. The mobile version of Microsoft Defender also includes a feature to block access to corporate data if it detects a malicious app is installed.
Microsoft Defender brand
As of 2021, Microsoft Defender Antivirus is part of the much larger Microsoft Defender brand, which includes several other software and service offerings, including:
* Microsoft 365 Defender
* Microsoft Defender for Cloud
* Microsoft Defender Endpoint
* Microsoft Defender for Office 365
* Microsoft Defender for Identity
* Microsoft Defender for Cloud Apps
* Microsoft Defender Vulnerability Management
* Microsoft Defender for Threat Intelligence
Features
Before Windows 8, Windows Defender only protected users against spyware. It includes a number of real-time security agents that monitor several common areas of Windows for changes which might have been caused by spyware. It also has the ability to remove installed
ActiveX
ActiveX is a deprecated software framework created by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly from the World Wide We ...
software. Windows Defender featured an integrated support for
Microsoft SpyNet
Microsoft Active Protection Service (abbreviated MAPS and formerly known as Microsoft SpyNet) is the network of Windows Defender and Microsoft Security Essentials users that help determine which programs are classified as spyware
Spyware ...
that allows users to report to Microsoft what they consider to be spyware, and what applications and device drivers they allow to be installed on their systems. Protection against viruses was subsequently added in Windows 8; which resembles Microsoft Security Essentials (MSE). It also uses the same anti-malware engine and
virus definitions from MSE.
In Windows 10, Windows Defender settings are controlled in the
Windows Defender Security Center
Security and Maintenance (formerly known as Action Center, and Security Center in earlier versions) is a component of the Windows NT family of operating systems that monitors the security and maintenance status of the computer. Its monitoring c ...
. In the
Windows 10 Anniversary Update, a new logo is introduced and a pop-up notification will appear to announce the results of a scan, even if no viruses are found.
Real-time protection
In the Windows Defender options, the user can configure
real-time protection options. Windows 10's Anniversary Update introduced Limited Periodic Scanning, which optionally allows Windows Defender to scan a system periodically if another antivirus app is installed.
It also introduced Block at First Sight, which uses machine learning to predict whether a file is malicious.
Browser integration
![Microsoft Defender Smartscreen](https://upload.wikimedia.org/wikipedia/commons/8/8b/Microsoft_Defender_Smartscreen.png)
Integration with
Internet Explorer
Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) is a series of graphical web browsers developed by Microsoft which was used in the Windows line of operating systems ( ...
and
Microsoft Edge
Microsoft Edge is a proprietary, cross-platform web browser created by Microsoft. It was first released in 2015 as part of Windows 10 and Xbox One and later ported to other platforms as a fork of Google's Chromium open-source project: Android ...
enables files to be scanned as they are downloaded to detect malicious software inadvertently downloaded. As of April 2018, Microsoft Defender is also available for
Google Chrome via an extension and works in conjunction with
Google Safe Browsing
Google Safe Browsing is a service from Google that warns users when they attempt to navigate to a dangerous website or download dangerous files. Safe Browsing also notifies webmasters when their websites are compromised by malicious actors and h ...
, but as of late 2022, this extension is now deprecated.
Application Guard
A feature released in early 2018, Windows Defender Application Guard is a feature exclusive to Microsoft Edge that allows users to
sandbox their current browsing session from the system. This prevents a malicious website or
malware from affecting the system and the browser. Application Guard is a feature only available on Windows 10 Pro and Enterprise. In May 2019, Microsoft announced Application Guard for Google Chrome and
Firefox
Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements current ...
. The extension, once installed, will open the current tabs web page in Microsoft Edge with Application Guard enabled.
Controlled Folder Access
![Controlled Folder Access](https://upload.wikimedia.org/wikipedia/commons/1/1b/Controlled_Folder_Access.png)
Controlled Folder Access is a feature introduced with Windows 10 Fall Creators Update to protect a user's important files from the growing threat of
ransomware. This feature was released about a year later after the
Petya family of ransomware first appeared. The feature will notify the user every time a program tries to access these folders and will be blocked unless given access via the user. Windows will warn the user with a
User Account Control
User Account Control (UAC) is a mandatory access control enforcement feature introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed popup as a final warning if they opt to "Allow" a program to read Controlled Folders.
History
Microsoft AntiSpyware (Beta 1)
Windows Defender was initially based on GIANT AntiSpyware, formerly developed by GIANT Company Software, Inc. The company's acquisition was announced by Microsoft on December 16, 2004.
While the original GIANT AntiSpyware officially supported older Windows versions, support for the
Windows 9x
Windows 9x is a generic term referring to a series of Microsoft Windows computer operating systems produced from 1995 to 2000, which were based on the Windows 95 kernel and its underlying foundation of MS-DOS, both of which were updated in su ...
line of operating systems was later dropped by Microsoft.
The first
beta release of ''Microsoft AntiSpyware'' from January 6, 2005, was a repackaged version of GIANT AntiSpyware.
There were more builds released in 2005, with the last Beta 1 refresh released on November 21, 2005.
At the 2005
RSA Security
RSA Security LLC, formerly RSA Security, Inc. and doing business as RSA, is an American computer and network security company with a focus on encryption and encryption standards. RSA was named after the initials of its co-founders, Ron Rive ...
conference,
Bill Gates
William Henry Gates III (born October 28, 1955) is an American business magnate and philanthropist. He is a co-founder of Microsoft, along with his late childhood friend Paul Allen. During his career at Microsoft, Gates held the positions ...
, the Chief Software Architect and co-founder of Microsoft, announced that Microsoft AntiSpyware would be made available free-of-charge to users with validly licensed
Windows 2000
Windows 2000 is a major release of the Windows NT operating system developed by Microsoft and oriented towards businesses. It was the direct successor to Windows NT 4.0, and was released to manufacturing on December 15, 1999, and was officiall ...
,
Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
, and
Windows Server 2003
Windows Server 2003 is the sixth version of Windows Server operating system produced by Microsoft. It is part of the Windows NT family of operating systems and was released to manufacturing on March 28, 2003 and generally available on April 24, 2 ...
operating systems to secure their systems against the increasing malware threat.
Windows Defender (Beta 2)
On November 4, 2005, it was announced that Microsoft AntiSpyware was renamed to ''Windows Defender''. Windows Defender (Beta 2) was released on February 13, 2006. It featured the program's new name and a redesigned user interface. The core engine was rewritten in
C++
C++ (pronounced "C plus plus") is a high-level general-purpose programming language created by Danish computer scientist Bjarne Stroustrup as an extension of the C programming language, or "C with Classes". The language has expanded significan ...
, unlike the original GIANT-developed AntiSpyware, which was written in
Visual Basic Visual Basic is a name for a family of programming languages from Microsoft. It may refer to:
* Visual Basic .NET (now simply referred to as "Visual Basic"), the current version of Visual Basic launched in 2002 which runs on .NET
* Visual Basic ( ...
. This improved the application's performance. Also, since Beta 2, the program works as a Windows service, unlike earlier releases, which enables the application to protect the system even when a user is not logged on. Beta 2 also requires
Windows Genuine Advantage
Windows Genuine Advantage (WGA) is an anti- infringement system created by Microsoft that enforces online validation of the licensing of several Microsoft Windows operating systems when accessing several services, such as Windows Update, and dow ...
(WGA) validation. However, Windows Defender (Beta 2) did not contain some of the tools found in Microsoft AntiSpyware (Beta 1). Microsoft removed the ''System Inoculation'', ''Secure Shredder'' and ''System Explorer'' tools found in MSAS (Beta 1) as well as the ''Tracks Eraser'' tool, which allowed users to easily delete many different types of temporary files related to
Internet Explorer 6
Microsoft Internet Explorer 6 (IE6) is a graphical web browser developed by Microsoft for Windows operating systems. Released on August 24, 2001, it is the sixth, and by now discontinued, version of Internet Explorer and the successor to Internet ...
, including
HTTP cookies
HTTP cookies (also called web cookies, Internet cookies, browser cookies, or simply cookies) are small blocks of data created by a web server while a user is browsing a website and placed on the user's computer or other device by the user's we ...
,
web cache
A Web cache (or HTTP cache) is a system for optimizing the World Wide Web. It is implemented both client-side and server-side. The caching of multimedias and other files can result in less overall delay when browsing the Web.
Parts of the sys ...
, and
Windows Media Player
Windows Media Player (WMP) is the first media player (application software), media player and media library application that was developed by Microsoft for playing sound reproduction, audio, video and viewing images on personal computers runnin ...
playback history.
German and Japanese versions of Windows Defender (Beta 2) were later released by Microsoft.
First release
On October 23, 2006, Microsoft
released the final version of Windows Defender. It supports Windows XP and Windows Server 2003; however, unlike the betas, it doesn't run on Windows 2000. Some of the key differences from the beta version are improved detection, redesigned user interface and delivery of definition updates via
Automatic Updates
Automatic may refer to:
Music Bands
* Automatic (band), Australian rock band
* Automatic (American band), American rock band
* The Automatic, a Welsh alternative rock band
Albums
* ''Automatic'' (Jack Bruce album), a 1983 electronic roc ...
.
Windows Defender had additional functionality in Windows Vista which was removed in subsequent versions of Windows:
Security agents
Security agents which monitor the computer for malicious activities:
* ''Auto Start'' – Monitors lists of programs that are allowed to automatically run when the user starts the computer
* ''System Configuration (settings)'' – Monitors security-related settings in Windows
* ''Internet Explorer Add-ons'' – Monitors programs that automatically run when the user starts Internet Explorer
* ''Internet Explorer Configurations (settings)'' – Monitors browser security settings
* ''Internet Explorer Downloads'' – Monitors files and programs that are designed to work with Internet Explorer
* ''Services and Drivers'' – Monitors services and drivers as they interact with Windows and programs
* ''Application Execution'' – Monitors when programs start and any operations they perform while running
* ''Application Registration'' – Monitors tools and files in the operating system where programs can register to run at any time
* ''Windows Add-ons'' – Monitors add-on programs for Windows
Software Explorer
The ''Advanced Tools'' section allows users to discover potential vulnerabilities with a series of Software Explorers. They provide views of startup programs, currently running software, network connected applications, and
Winsock
In computing, the Windows Sockets API (WSA), later shortened to Winsock, is an application programming interface (API) that defines how Windows network application software should access network services, especially TCP/IP. It defines a standar ...
providers (
Winsock LSPs). In each Explorer, every element is rated as either "Known", "Unknown" or "Potentially Unwanted". The first and last categories carry a link to learn more about the particular item, and the second category invites users to submit the program to Microsoft SpyNet for analysis by community members.
The Software Explorer feature has been removed from Windows Defender in Windows 7.
Notification of startup programs that run as an administrator
Windows Defender in Windows Vista automatically blocks all startup items that require administrator privileges to run (this is considered suspicious behavior for a startup item). This automatic blocking is related to the
User Account Control
User Account Control (UAC) is a mandatory access control enforcement feature introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed functionality in Windows Vista, and requires users to manually run each of these startup items each time they log in if they desire the item to run at startup.
Conversion to antivirus
Windows Defender was released with Windows Vista and Windows 7, serving as their built-in ''
anti-spyware
Spyware (a portmanteau for spying software) is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their priva ...
'' component. In Windows Vista and Windows 7, Windows Defender was superseded by
Microsoft Security Essentials
Microsoft Security Essentials (MSE) is an antivirus software (AV) product that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and Trojan horses. Prior to version 4.5, MSE ran on , ...
, an ''antivirus'' product from Microsoft which provided protection against a wider range of malware. Upon installation, Microsoft Security Essentials disabled and replaced Windows Defender.
In Windows 8, Microsoft upgraded Windows Defender into an ''
antivirus
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the nam ...
'' program very similar to Microsoft Security Essentials for Windows 7
and using the same virus definition updates. Microsoft Security Essentials itself does not run on Windows versions beyond 7.
In Windows 8 and Windows 10, Windows Defender is on by default. It switches itself off upon installation of a third-party anti-virus package.
Windows Server 2016
Windows Server 2016 is the eighth release of the Windows Server Server (computing), server operating system developed by Microsoft as part of the Windows NT family of operating systems. It was developed concurrently with Windows 10 and is the su ...
was the first version of Windows Server to include Windows Defender.
UI changes
Until
Windows 10 version 1703
Windows 10 Creators Update (also known as version 1703 and codenamed "Redstone 2") is the third major update to Windows 10 and the second in a series of updates under the Redstone codenames. It carries the build number 10.0.15063.
PC version histo ...
, Windows Defender had a dedicated GUI similar to Microsoft Security Essentials.
Additionally,
Windows Security and Maintenance tracked the status of Windows Defender. With the first release of Windows 10, Microsoft removed the "Settings" dialog box from Windows Defender's GUI in favor of a dedicated page in the
Settings app. Then, in the 1703 update, Microsoft tried to merge both Windows Defender's GUI and Windows Security and Maintenance into a unified
UWP app called
Windows Defender Security Center
Security and Maintenance (formerly known as Action Center, and Security Center in earlier versions) is a component of the Windows NT family of operating systems that monitors the security and maintenance status of the computer. Its monitoring c ...
(WDSC). Users could still access original GUI by alternative methods, until the
1803 update, which saw the UI removed altogether. The Security and Maintenance app, however, was never removed.
With the release of Windows Server 2016, Microsoft introduced a Defender module for
PowerShell
PowerShell is a task automation and configuration management program from Microsoft, consisting of a command-line shell (computing), shell and the associated scripting language. Initially a Windows component only, known as Windows PowerShell, it ...
, which allows interacting with Windows Defender via a
command-line interface
A command-line interpreter or command-line processor uses a command-line interface (CLI) to receive commands from a user in the form of lines of text. This provides a means of setting parameters for the environment, invoking executables and pro ...
(CLI).
Microsoft continued to decouple the management front-end from the core antivirus. In addition, to WDSC and PowerShell, it is possible to manage the antivirus via
Windows Admin Center
Windows Admin Center (code-named Project Honolulu) is a web program released by Microsoft on April 12, 2018 as an evolution of the Windows Server graphical user interface (GUI). Officially launched in public preview under the code name Project Hon ...
,
Group Policy
Group Policy is a feature of the Microsoft Windows NT family of operating systems (including Windows 7, Windows 8.1, Windows 10, Windows 11, and Windows Server 2003+) that controls the working environment of user accounts and computer accounts. G ...
,
WMI,
Microsoft Endpoint Manager
Microsoft Intune (formerly Windows Intune) is a Microsoft cloud-based unified endpoint management service for both corporate and BYO devices. It extends some of the "on-premises" functionality of Microsoft Endpoint Configuration Manager to the ...
. and
Microsoft Intune
Microsoft Intune (formerly Windows Intune) is a Microsoft cloud-based unified endpoint management service for both corporate and BYO devices. It extends some of the "on-premises" functionality of Microsoft Endpoint Configuration Manager to the ...
's "tenant attach" feature.
Changes in branding and business focus
In Windows 10 version 1707, Microsoft renamed Windows Defender, calling it Windows Defender Antivirus.
Windows Firewall
Windows Firewall (officially called Microsoft Defender Firewall in Windows 10 version 2004 and later) is a firewall component of Microsoft Windows. It was first included in Windows XP SP2 and Windows Server 2003 SP1. Before the release of Windows ...
and
Microsoft SmartScreen
SmartScreen (officially called Windows SmartScreen, Windows Defender SmartScreen and SmartScreen Filter in different places) is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating syst ...
also saw their names changed to Windows Defender Firewall and Windows Defender SmartScreen.
Microsoft added other components under the "Windows Defender" brand name, including
Windows Defender Application Guard
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for se ...
(WDAG),
Window Defender Exploit Guard (WDEG),
Windows Defender Application Control
Windows is a group of several Proprietary software, proprietary graphical user interface, graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, W ...
,
and
Windows Defender Advanced Threat Protection (Defender ATP).
A year later, Microsoft began dissolving the Windows Defender brand in favor a of the cloud-oriented
"Microsoft Defender" brand. The company removed WDSC from the brand in the
1809 update, renaming it ''Windows Security Center (WSC)''. The
2004 update renamed Windows Defender Antivirus, calling it ''Microsoft Defender Antivirus'', as Microsoft extended Defender ATP's capabilities beyond the Windows OS.
Windows Defender Offline
Windows Defender Offline (formerly known as Standalone System Sweeper) is a stand-alone anti-malware program that runs from bootable removable media (e.g. CD or USB flash drive) designed to scan infected systems while the Windows operating system is offline.
Since Windows 10 Anniversary Update in 2016, the option to boot into Windows Defender Offline can be initiated from within Windows itself, negating the need for the separate boot disk.
Mitigated security vulnerability
On May 5, 2017, Tavis Ormandy, a vulnerability researcher from
Google
Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...
, discovered a
security vulnerability
Vulnerabilities are flaws in a computer system that weaken the overall security of the device/system. Vulnerabilities can be weaknesses in either the hardware itself, or the software that runs on the hardware. Vulnerabilities can be exploited by ...
in the
JavaScript
JavaScript (), often abbreviated as JS, is a programming language that is one of the core technologies of the World Wide Web, alongside HTML and CSS. As of 2022, 98% of Website, websites use JavaScript on the Client (computing), client side ...
analysis module (''NScript'') of Microsoft Antimalware Engine (''MsMpEngine'') that impacted Windows Defender,
Microsoft Security Essentials
Microsoft Security Essentials (MSE) is an antivirus software (AV) product that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and Trojan horses. Prior to version 4.5, MSE ran on , ...
and
System Center Endpoint Protection. By May 8, 2017, Microsoft had released a patch to all affected systems. ''
Ars Technica
''Ars Technica'' is a website covering news and opinions in technology, science, politics, and society, created by Ken Fisher and Jon Stokes in 1998. It publishes news, reviews, and guides on issues such as computer hardware and software, sci ...
'' commended Microsoft for its unprecedented patching speed and said that the disaster had been averted.
Reviews
During a December 2017 test of various anti-malware software carried out by
AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
on Windows 10, Windows Defender earned 6 out of 6 points in detection rate of various malware samples, earning its "AV-TEST Certified" seal.
During a February 2018 "Real-World Protection Test" performed by
AV-Comparatives
AV-Comparatives is an Austrian independent organization that tests and assesses antivirus software, regularly releasing charts and reports that are freely available to the public and the media. Antivirus vendors have to meet various requirements r ...
, Windows Defender achieved a 100% detection rate of malicious URL samples, along with 3
false positive
A false positive is an error in binary classification in which a test result incorrectly indicates the presence of a condition (such as a disease when the disease is not present), while a false negative is the opposite error, where the test result ...
results.
An AV-TEST test of Windows Defender in October 2019 demonstrated it provides excellent protection both against viruses and 0-day / malware attacks.
On December 1, 2021, AV-TEST gave Defender a maximum protection score of 34 points after successfully managing to detect ten out of ten ransomware samples in a lab test.
See also
*
Security and safety features new to Windows Vista
There are a number of security and safety features new to Windows Vista, most of which are not available in any prior Microsoft Windows operating system release.
Beginning in early 2002 with Microsoft's announcement of its Trustworthy Computin ...
*
Windows Security Center
Notes
References
External links
*
{{Antivirus software
2006 software
Microsoft software
Microsoft Windows security technology
Spyware removal
Windows components
Windows-only freeware
Windows security software