The built-in antivirus is now called Windows Security, and its engine is still Microsoft Defender. It is good enough, free, and ad-free, but it occasionally "friendly-fires" on your games or dev tools. Here is how to use it day to day, how to recover from mistakes, and the pitfalls to avoid.
1. Know the interface: it is now "Windows Security"
Win + I > Privacy and security > Windows Security (formerly Windows Defender). Virus and threat protection, account protection, and firewall and network protection are the parts you use most.
2. Temporarily turn off real-time protection (troubleshooting only)
- Go to Virus and threat protection > Manage settings.
- Turn off Real-time protection (usually temporary; it comes back after a restart or after a while).
Do not leave it off long term. Browsing unprotected or plugging in unknown USB drives is risky. Turn it back on when you are done.
3. Add exclusions (the right move, prevents false deletes)
Better than "turning off protection": add your game folder, dev folder, and download folder to the exclusion list, and Defender leaves them alone.
- Virus and threat protection > Manage settings > Exclusions > Add or remove exclusions.
- You can exclude a folder (game library, code repo), a file, a process, or a file type.
This avoids false kills while keeping the rest of the system protected. Dev tools (Python, Node, Go build outputs) and game mods are the ones most worth excluding.
4. Recover a file Defender deleted
- Virus and threat protection > Protection history.
- Find the quarantined item > Restore, and add its folder to exclusions (section 3) while you are at it.
- If it was "removed" and never hit quarantine, recovery odds are low, so act fast.
5. SmartScreen: "Windows protected your PC"
Downloads from the web are often blocked by SmartScreen with "Windows protected your PC". Once you trust the source:
- Right-click the installer > Properties > bottom "Unblock" > OK.
- Or use PowerShell:
Unblock-File -Path "D:\Downloads\setup.exe"
- In a corporate environment you can disable it via group policy; ordinary users should not leave it off long term. For how to open group policy and common settings, see How to Use the Registry Editor (regedit) and Group Policy (gpedit).
6. Controlled folder access (anti-ransomware)
Virus and threat protection > Ransomware protection > Controlled folder access. Once on, it protects your Documents, Pictures, and similar folders from being rewritten by unknown programs, a solid extra layer against ransomware.
7. Allow an app through Windows Firewall
Sometimes you need to let a program through, for example an online game or Remote Desktop.
- Advanced settings > Inbound rules > New rule to allow; or tick it under Allow an app through firewall.
- Remote Desktop and LAN sharing often need this; see How to Use Windows Remote Desktop (RDP) and Windows File and Printer Sharing on a Local Network.
8. Third-party antivirus conflicts
Huorong, 360, and Defender together will delete and block each other. Install one mainstream product and do not stack them.
9. Common false-positive scenarios
- Key generators, trainers, cheats, and unsigned dev tools are the most likely to be flagged.
- The rule: confirm the source is trusted, add it to exclusions (section 3), then run it. Do not disable the whole protection just for convenience.
Wrap-up
Defender is enough for daily use, so don't rush to disable it. False deletes are solved with "exclusions plus restore from protection history"; SmartScreen blocks on downloads are cleared with "Unblock"; turn on "Controlled folder access" to fight ransomware. Pick one third-party antivirus and stop there, because stacking them makes them fight.