A New Windows 11 Laptop Already Has Antivirus Built In

You don’t have to buy antivirus to have it on a new Windows 11 laptop: Windows Security, built into Windows 11, includes Microsoft Defender Antivirus with real-time protection, and a firewall that Microsoft says is on by default. If the laptop came with another company’s antivirus trial, Microsoft says Defender Antivirus turns itself off while that app is installed and turned on, and turns back on when it is removed.

Microsoft describes the Windows Security app as “built into Windows, ensuring that your device is protected from the moment you start it up.” What Microsoft’s pages do not give is a detection rate, so this page sets out what each piece does in Microsoft’s words, and how to see which antivirus is running on yours.

What Windows 11 includes, and what the Microsoft 365 app adds

Microsoft offers a second product with a similar name. Windows Security is built into Windows. Microsoft Defender is a separate app that Microsoft says is “included as part of your Microsoft 365 Family, or Personal, subscription at no extra cost.”

Protection	Windows Security (built into Windows 11)	Microsoft Defender app (with Microsoft 365)	Note
Antivirus scanning in real time	Yes: Defender Antivirus “continuously scans your device”	Yes: real-time anti-malware “runs whenever your device is on”	The app “works alongside your existing antimalware solutions”
Scans on demand	Quick, full, custom and offline scans	A scan from the Device protection page, plus daily quick scans	Offline scan restarts the PC
Threat definition updates	Downloaded “as part of Windows Update”	Not described on the app pages we read
Firewall	Windows Defender Firewall, on by default	Not part of the app	Built into Windows either way
Dangerous sites and downloads	Microsoft Defender SmartScreen, for apps, files and Edge	Web protection; on Windows “provided by Microsoft Defender SmartScreen in the Microsoft Edge browser”	Same feature on a Windows PC
Ransomware folder lock	Controlled folder access, off until you turn it on	Not described on the app pages we read	Works only with Defender Antivirus active
Untrusted app blocking	Smart App Control, on new Windows 11 installs only	Not described on the app pages we read	Starts in evaluation mode
Phones and Macs	Windows only	Windows, Mac, iPhone and Android; up to 5 devices per person	Anti-malware on Windows, Mac and Android only
Identity theft monitoring	No	Listed, with Experian, for US customers only	Not confirmed in the app

The Windows Security home page splits all of this into 8 protection areas, from Virus & threat protection to Protection history. Microsoft’s overview says the green, yellow and red icons on each one mean, in turn, nothing to do, a safety recommendation, and something that “needs your immediate attention”.

On a Windows PC, the web protection row is the same feature in both columns. Microsoft’s own Defender app page says web protection on Windows is SmartScreen in Edge, which Windows Security already includes.

What happens to Defender when another antivirus is installed

The support page is plain: “If you have another antivirus app installed and turned on, Microsoft Defender Antivirus turns off automatically. If you uninstall the other app, Microsoft Defender Antivirus turns back on automatically.” A second Microsoft page says the same in fewer words: “If you install a compatible non-Microsoft antivirus program Microsoft Defender antivirus will automatically turn itself off.”

Microsoft Learn, written for IT staff, names the states. On a Windows 11 PC that is not enrolled in a business service, Defender Antivirus is in active mode when it is the main antivirus, and in disabled mode when another product is, which it says “happens automatically”. The exception is Smart App Control: with it on, or still in evaluation, Defender Antivirus goes into passive mode instead. In disabled mode, Microsoft says, “Files aren’t scanned and threats aren’t remediated” by Defender.

When a trial runs out, Microsoft’s Learn page on limited periodic scanning says Defender Antivirus “also turns on if the other product is out-of-date, expired, or not working.” Its compatibility page is more cautious, saying Defender “can be re-enabled automatically” in those cases, so it is worth checking the Security providers page (below) after a trial ends.

Two things stop working while another antivirus is in charge. Controlled folder access needs Defender Antivirus “enabled and in Active mode”, and Microsoft says it “doesn’t work in any other modes”. And the one Defender option left beside the other product, limited periodic scanning, is narrow: Microsoft says it “uses only a small part of Microsoft Defender Antivirus to find threats. It can’t detect most malware or unwanted software.” Installing another antivirus also takes Controlled folder access out of use. Smart App Control, by Microsoft’s account, “works alongside” non-Microsoft antivirus tools, and the pages we read describe the antivirus turning off, not the firewall or SmartScreen.

How to check which antivirus is on

1. Open Windows Security from the Start menu.
2. Select Virus & threat protection.
3. Under Who’s protecting me?, select Manage providers. Under Antivirus, the Security providers page names the one that is on, for example “Microsoft Defender Antivirus is turned on”.
4. Back on Virus & threat protection, Manage settings shows the Real-time protection toggle. Microsoft says that if you switch it off, it “will turn back on automatically after a short while”.

For a second check, Microsoft Learn says Defender Antivirus runs as MsMpEng.exe on the Details tab of Task Manager. In PowerShell, Get-MpComputerStatus | select AMRunningMode returns “Normal, Passive, or EDR Block Mode” when antivirus protection is on.

Settings worth knowing, in Microsoft’s words

• Tamper protection “helps prevent malicious apps from changing important Microsoft Defender Antivirus settings”, such as real-time and cloud-delivered protection. An administrator can still change them in the app.
• Controlled folder access is off by default. Once on, Microsoft says it protects “common folders such as Documents, Pictures, Videos, Music, and Desktop” from untrusted apps. It is under Virus & threat protection › Manage ransomware protection.
• Smart App Control can be used “on new Windows 11 installs only”. It starts in evaluation mode and, if Windows judges you a good candidate, turns itself on; once it is on or off, you can’t return to evaluation without resetting Windows.
• Exclusions stop Defender scanning a file, folder, file type or process in real time. Microsoft calls an exclusion “safer than turning the entire antivirus protection off”, and warns it “could leave your device and data vulnerable”.

Before you keep or remove a trial

A laptop in S mode, or one with a Snapdragon chip, has antivirus rules of its own: our S mode guide covers which antivirus Microsoft lists as compatible in S mode, and a limit it gives for third-party antivirus on Snapdragon PCs. If you also want a VPN, what a VPN hides and what it doesn’t explains why one is not a substitute for antivirus. And on a Windows 10 PC you are replacing, Defender’s definitions run longer than the operating system’s own fixes, as our Windows 10 security updates guide sets out.

If you remove the trial, Microsoft says Defender Antivirus turns back on by itself. If you keep it and pay, Windows hands antivirus duty to it and switches off Defender’s own scanning and its ransomware folder lock while it does.

Questions people ask

Do I need to buy antivirus for Windows 11?

You do not need to buy one to have antivirus. Windows 11 includes Microsoft Defender Antivirus in the Windows Security app, with real-time protection, and Windows Defender Firewall, which Microsoft says is on by default.

Is Windows Defender enough for Windows 11?

Microsoft describes what Defender does, not how it compares: real-time scanning, cloud-delivered protection, tamper protection, SmartScreen and an optional ransomware folder lock. Microsoft’s pages publish no detection rates, and we have not tested it against a paid suite.

Does Windows Defender turn off when I install another antivirus?

Yes. Microsoft says that if another antivirus app is installed and turned on, Defender Antivirus turns off automatically. Its Learn page calls this disabled mode, or passive mode on Windows 11 when Smart App Control is on or in evaluation.

What happens when my antivirus trial expires?

Microsoft’s Learn page says Defender Antivirus turns on if the other product is out of date, expired or not working, and the support page says it turns back on if you uninstall the other app. Check the Security providers page in Windows Security to confirm.

How do I check if Windows Defender is on?

Open Windows Security, select Virus & threat protection, then under Who’s protecting me? select Manage providers. Under Antivirus, the Security providers page shows which antivirus is on. Manage settings, on the same page, shows the Real-time protection toggle.

What does Microsoft Defender in Microsoft 365 add?

It is a separate app for Windows, Mac, iPhone and Android, included with Microsoft 365 Personal or Family. It adds one dashboard for up to 5 devices per person; on Windows, Microsoft says its web protection is SmartScreen in Edge.