Microsoft Defender Settings Worth Turning On Today

Most Windows users already have a capable antivirus installed and never open it. Microsoft Defender ships with every copy of Windows 10 and 11, but several of its strongest protections are switched off by default or quietly turned off by other software. Spending ten minutes on the right Microsoft Defender settings closes gaps that ransomware and unwanted programs regularly slip through, and it costs nothing.

I check these settings on every machine I set up for clients, from a single home laptop to a twenty person office. Here is exactly where each one lives, what it does, and which ones to be careful with.

Where to find Microsoft Defender settings

Defender lives inside the Windows Security app. Open the Start menu, type "Windows Security" and press Enter. You will see a dashboard with sections including Virus and threat protection, Account protection, Firewall and network protection, App and browser control, and Device security.

A green tick on each section means the basics are on. It does not mean every useful option is enabled. The settings below sit one or two clicks deeper.

One quick check before you start: if another antivirus product is installed, Defender may have stepped aside into passive mode. If you meant to remove that product, uninstall it properly so Defender can take over fully.

The core protections to confirm first

Go to Virus and threat protection, then click Manage settings under "Virus and threat protection settings." Make sure these four are on:

Real-time protection. Scans files as they are opened or downloaded. If this is off and you did not turn it off, treat that as a warning sign that something else did.
Cloud-delivered protection. Sends suspicious file signatures to Microsoft for a fast verdict on brand new threats, often within seconds.
Automatic sample submission. Lets Defender upload suspicious files for analysis. Privacy-conscious users can set this to prompt instead, though leaving it on improves detection.
Tamper Protection. Stops malware or scripts from switching Defender off behind your back. This one matters more than most people realise.

Settings that are off by default but worth turning on

Controlled folder access

This is Defender's ransomware protection. Under Virus and threat protection, scroll to Ransomware protection and click Manage ransomware protection. Turning on Controlled folder access means only approved apps can change files in protected folders such as Documents, Pictures and Desktop.

Expect some friction in the first week. Legitimate apps, such as an older photo editor or a game saving to Documents, may be blocked. Windows shows a notification, and you can allow the app with two clicks under "Allow an app through Controlled folder access." In my experience most people need to approve between two and five apps, then never think about it again.

Potentially unwanted app blocking

Go to App and browser control, then Reputation-based protection settings. Turn on Potentially unwanted app blocking and tick both "Block apps" and "Block downloads." This catches bundled toolbars, aggressive adware and fake system cleaners that are not strictly malware but cause real problems.

Memory integrity

Under Device security, click Core isolation details and turn on Memory integrity. It uses hardware virtualisation to stop malicious code from tampering with the most sensitive parts of Windows. On most computers from the last five or six years it works without issues. If Windows reports incompatible drivers, note the driver names and check for updates from the hardware maker before forcing anything.

Scans and updates worth scheduling

Defender runs quick scans automatically during idle time. Two manual habits add useful coverage:

Monthly full scan. Under Virus and threat protection, click Scan options, choose Full scan and let it run. On a typical SSD with 300 GB used, expect 30 to 90 minutes.
Offline scan when something feels wrong. The Microsoft Defender Offline scan restarts the PC and scans before Windows loads, catching rootkits that hide from a normal scan. It takes about 15 minutes.
Check protection updates. Click Protection updates and then Check for updates. Definitions normally update several times a day, but if the "last update" date is more than two days old, Windows Update may be stuck.

Is free Defender enough, or do you need paid antivirus?

Many buying guides still tell readers that the built-in antivirus is a bare minimum and that a paid suite is essential. I disagree for most home users and small offices. Independent test labs have rated Defender's malware detection alongside the leading paid products for several years now, and it is maintained by the same company that writes the operating system, so it integrates cleanly and rarely causes slowdowns.

Paid suites mostly add extras: VPNs, password managers, identity monitoring, and parental controls. Some of those are useful, but they can be bought separately and often better. The real security gaps I find on client machines are almost never "wrong antivirus." They are Tamper Protection off, no ransomware protection, no backups and weak passwords.

The exception is a business that needs central management of many devices, reporting and response tools. That is where Microsoft's business tiers or a dedicated endpoint product earn their cost. For everyone else, configuring Defender properly plus the habits in the free security tools worth setting up first covers most risk.

What Defender cannot do for you

Even perfectly configured, antivirus is one layer. It will not stop you from typing your password into a convincing fake login page, and it cannot restore files once ransomware has encrypted a folder it did not protect. Keep offline or versioned backups, and if you run a team, follow a written plan like the one in a small business backup plan that survives ransomware.

If you have just bought a used computer, run through these settings as part of a full reset. Our checklist for how to secure a secondhand laptop before first use puts them in the right order alongside a clean Windows install.

Frequently asked questions

Is Microsoft Defender good enough on its own?

For most home users and small businesses, yes. Independent labs consistently rate its detection highly. Pair it with backups, strong unique passwords, two-factor authentication and the extra settings above for solid protection.

Why is Tamper Protection turned off on my PC?

It may have been disabled by another security product, an administrator, or in some cases malware. Turn it back on in Virus and threat protection settings. If it keeps switching off by itself, run a Microsoft Defender Offline scan.

Will controlled folder access break my apps?

It can block some legitimate programs from saving to protected folders at first. Windows notifies you when this happens, and you can allow the app in a few clicks. Most users only need to approve a handful of programs.