Windows 11 Defender Setup: 13 Steps, 60 Min [2026]

Microsoft pushed the Windows 11 26H2 rollout into wider release this fall, and the October 13, 2026 cumulative update, KB5127648, landed across every active Windows 11 branch at once. That single patch touched build 26300.9711 for the new 26H2 line, build 26200.9711 for 25H2, and build 26100.9711 for 24H2, according to Windows Forum’s release notes for the update. It is a good moment to ask a question that keeps resurfacing every time Windows gets a major refresh: do you still need a separate antivirus program, or does Microsoft Defender Antivirus already cover you?

This tutorial is a hands-on setup guide, not a ranked shopping list. You will configure Microsoft Defender Antivirus for Windows 11, check whether Smart App Control and Core Isolation are available on your machine, and, if you decide you want a third-party engine running alongside Defender, install it without creating the kind of real-time scanning conflict that slows a PC to a crawl or triggers false positives. By the end you will have a working, tested security baseline and a reusable PowerShell script that checks it for you going forward.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

Why Windows 11 26H2 Changes the Antivirus Conversation

Windows 11 26H2, which Microsoft also labels the 2026 Update, is rolling out in phases to eligible Windows 11 24H2 and 25H2 devices that have opted into receiving new feature updates as soon as they are offered. Windows 11 25H2 is still a fully supported, actively patched branch in its own right, and it received the same October 13, 2026 security build referenced above. In practice that means three Windows 11 branches, 24H2, 25H2 and 26H2, are all receiving monthly security servicing in parallel right now, and the build number alone tells you which one you are on.

That matters for antivirus setup because Microsoft Defender Antivirus for Windows 11 ships as part of the operating system rather than as a separate download, and its behavior, especially around Smart App Control and passive mode, depends on which branch and which installation path you are running. Microsoft’s own guidance puts it plainly: “Windows 11 security comes with Microsoft Defender Antivirus, so you’re already protected from the start.” The company adds that “for many users, this level of protection is plenty,” while acknowledging that “some third-party tools offer extras (like identity monitoring or built-in VPNs), but Microsoft Defender covers the essentials,” in its consumer-facing security guidance. That same monthly servicing cadence is documented across Microsoft’s support site for every build, including its write-up of the January 13, 2026 cumulative update, KB5074109, which shows the same 25H2-and-24H2 build-numbering pattern that carried through to October’s KB5127648.

At the same time, Microsoft’s own support documentation is explicit about the risk of running two security products at once: “We recommend that you do not run other antivirus or antispyware products at the same time as Windows Defender.” That is the tension this tutorial resolves. You can run Microsoft Defender Antivirus for Windows 11 alongside a third-party engine, but only if you understand how passive mode works, and the sections below cover you exactly how to verify it.

Windows 11 24H2 vs 25H2 vs 26H2: What Changed for Antivirus Users

Because three branches of Windows 11 are all receiving security updates in parallel right now, it helps to see what actually separates them before you start configuring anything. The build number is the only reliable signal, since a 25H2 machine and a 26H2 machine can look nearly identical in the Settings app while running different underlying code.

Branch	Build after Oct 13, 2026 (KB5127648)	Smart App Control on a fresh install	Support status
Windows 11, version 24H2	26100.9711	Available since original release	Actively patched monthly
Windows 11, version 25H2	26200.9711	Available since original release	Actively patched monthly, current mainstream branch
Windows 11, version 26H2	26300.9711	Available since original release	Phased rollout, offered to eligible 24H2/25H2 devices

The practical point this table makes is one that is easy to miss: Smart App Control’s availability depends on whether your specific installation was ever a clean install, not on which of these three branches you are currently running. A PC first set up on 24H2 and upgraded in place all the way to 26H2 still will not have the Smart App Control toggle, while a PC freshly installed with 26H2 will have it from day one. Step 5 below shows exactly how to check which situation applies to your machine, rather than guessing based on the version label alone.

Prerequisites: What You’ll Need Before You Start

This walkthrough assumes a standard Windows 11 PC, not a managed enterprise device locked down by Group Policy or Intune (those readers should skip to the advanced tips section). Gather the following before Step 1:

• Windows 11, version 24H2, 25H2, or 26H2, with the October 13, 2026 security update (KB5127648, builds 26100.9711 / 26200.9711 / 26300.9711) or later installed
• An account with local administrator rights (several steps require elevated PowerShell)
• A PC that meets the Windows 11 TPM 2.0 and UEFI Secure Boot baseline, since Core Isolation and several Defender features depend on it
• At least 10 GB of free disk space if you plan to install a third-party antivirus engine
• PowerShell 5.1 or later, which ships with every current Windows 11 build, run as Administrator
• Roughly 60 minutes, including two restarts (one for Core Isolation, one after the third-party AV install)
• Optional: a licensed copy of a third-party antivirus product if you are choosing the layered path rather than Defender-only. The August 2026 AV-TEST Windows 11 round, referenced later Independently evaluated versions including Bitdefender Total Security 27.0, ESET Security Ultimate 19.1/19.2, Kaspersky Premium 21.24/21.25, Malwarebytes Premium 5.5/5.6, and Norton 360 26.6/26.7

Understanding Windows 11’s Native Security Stack

Before touching any settings, it helps to know what each piece of Windows 11’s built-in security actually does, because the names get conflated constantly in forum threads and support tickets.

Microsoft Defender, Smart App Control and Core Isolation Are Not the Same Thing

Microsoft Defender Antivirus is the real-time, signature-and-behavior-based malware scanner. Smart App Control is a separate, reputation-based gatekeeper that blocks unknown or untrusted applications from running at all, working alongside Defender rather than replacing it. Core Isolation, specifically its Memory Integrity sub-feature, is a virtualization-based security layer that protects the Windows kernel from code-injection attacks by running core processes in an isolated environment backed by your CPU’s virtualization extensions. Windows Hello, meanwhile, is an identity and sign-in feature (PIN, fingerprint, or facial recognition) that has nothing to do with malware scanning, it just reduces how often you type a password that could be phished.

What’s Different About Antivirus Behavior in 26H2

The detail that trips up the most people migrating to 26H2: Smart App Control can only be turned on during a clean installation of Windows 11. If it arrives through an in-place feature update on a PC that is already running, Microsoft’s documentation confirms it cannot be enabled without a full reset or reinstall of Windows. That means a PC upgraded from 24H2 to 26H2 will not gain a fresh Smart App Control toggle just because the build number changed, you have to check its actual state rather than assume. The other behavior worth knowing up front: when Smart App Control is turned on and you install a third-party antivirus, Microsoft Defender Antivirus typically drops into passive mode instead of fully disabling. Without Smart App Control, installing a third-party AV usually disables Defender’s real-time engine entirely. Step 9 below shows you how to check which state you are actually in.

Step 1: Confirm Your Windows 11 Version and Build Number

Everything else Depends on knowing exactly which Windows 11 branch and build you are running, since Smart App Control eligibility and some Defender defaults differ between 24H2, 25H2, and 26H2. Open PowerShell as Administrator and run:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, OsHardwareAbstractionLayer

Expect output similar to this on a fully patched machine:

WindowsProductName             : Windows 11 Pro
WindowsVersion                 : 25H2
OsBuildNumber                  : 26200
OsHardwareAbstractionLayer     : 10.0.26200.9711

If WindowsVersion still shows 24H2 or 25H2 and you expected 26H2, that is normal. Microsoft’s phased rollout means not every eligible device gets offered the 26H2 feature update on the same day, and running the base build current for your branch (26100.9711, 26200.9711, or 26300.9711 as of the October 13, 2026 patch) is what actually matters for security, not the version label by itself.

Step 2: Check TPM 2.0 and Secure Boot Status

TPM 2.0 is part of the Windows 11 security baseline, and Core Isolation’s Memory Integrity feature, which you will enable in Step 6, depends on it along with UEFI Secure Boot. Confirm both before going further:

Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, ManufacturerVersion
Confirm-SecureBootUEFI

You want TpmPresent and TpmEnabled to both read True, and Confirm-SecureBootUEFI should return True. If Secure Boot returns False or throws an error about a non-UEFI firmware, Core Isolation will either refuse to turn on or will not protect you the way it is designed to, and you should resolve that in your firmware settings before continuing.

Step 3: Open Windows Security and Audit Your Current Protection

Windows Security is the control center for Microsoft Defender Antivirus, the firewall, account protection, and device security, and it is the interface you should trust over any older screenshot or tutorial from a previous Windows 11 release. Open it by searching “Windows Security” in the Start menu, then walk through each tile:

• Virus & threat protection: confirm real-time protection shows as on, and note the date of the last quick scan
• Account protection: check whether Windows Hello is configured (covered in Step 11)
• Firewall & network protection: confirm the firewall is on for your current network profile
• App & browser control: this is where Smart App Control’s actual state lives, not just its theoretical availability
• Device security: this is where Core Isolation and Memory Integrity live

If any tile shows a red or yellow warning icon, resolve it before moving to the next step. A yellow warning under Virus & threat protection most often means a scan is overdue or a previous third-party antivirus was removed without a full uninstall.

Step 4: Decide Between Defender-Only and a Layered Setup

This is the decision the rest of the tutorial branches from. Based on independent AV-TEST results covered in detail later Microsoft Defender Antivirus for Windows 11 scored a perfect 18 out of 18 (6/6 protection, 6/6 performance, 6/6 usability) in AV-TEST’s December 2025 evaluation, with a 100 percent real-world protection rate and 100 percent detection against the reference malware set, per AV-TEST’s published results for Defender 4.18. That is a strong baseline on its own. The case for adding a third-party product is usually about extra features, identity-theft monitoring, a bundled VPN, parental controls, or a vendor’s own ransomware rollback tool, not a meaningfully higher detection rate. If you decide to stay Defender-only, skip to Step 6. If you want a layered setup, continue to Step 5.

Step 5: Check Smart App Control Eligibility

Before installing anything else, check whether Smart App Control is actually available on your installation, since, as covered above, it only activates on new installs. Run:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -ErrorAction SilentlyContinue

A value of 2 means it is running in evaluation mode, 1 means it is on and enforcing, and 0 (or no value at all, with an error returned) means it is off or was never available on this install. If your PC was upgraded in place from an older Windows 11 build rather than freshly installed, do not be surprised to see it off with no option to toggle it in Windows Security. That is expected behavior, not a bug.

Step 6: Turn On Core Isolation and Memory Integrity

With TPM and Secure Boot confirmed in Step 2, open Windows Security, go to Device security, then Core isolation details, and switch Memory integrity to On. Restart when prompted. After the restart, verify it actually stuck:

Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesRunning

You should see HypervisorEnforcedCodeIntegrity in the returned list. If Windows refused to re-enable Memory Integrity after the restart, an outdated or unsigned third-party driver is almost always the cause, and Windows Security will usually name the offending driver directly on the Core isolation page.

Step 7: Tune Microsoft Defender’s Cloud Protection and Exclusions

Whether or not you are adding a third-party engine, it is worth confirming Defender’s cloud-delivered protection is actually active, since that is what drives its fast-reacting detection against brand-new threats. Check current settings:

Get-MpPreference | Select-Object DisableRealtimeMonitoring, MAPSReporting, SubmitSamplesConsent, CloudBlockLevel

DisableRealtimeMonitoring should read False, and MAPSReporting should be 1 or 2 (basic or advanced membership in Microsoft’s cloud protection network). If you need to turn cloud protection back on:

Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendSafeSamples

Resist the urge to add broad folder exclusions here unless a specific, named application genuinely requires it (see the pitfalls section below), since every exclusion is a blind spot for both Defender and any second scanner you add later.

Step 8: Install Your Third-Party Antivirus the Right Way

If you chose the layered path in Step 4, download the installer directly from the vendor’s own site, never a third-party mirror, and close Windows Security before running it. During installation, most modern antivirus products will detect Microsoft Defender Antivirus for Windows 11 automatically and either prompt you to disable its real-time engine or do so silently as part of the install. Let the installer manage that handoff rather than manually disabling Defender yourself beforehand, since doing it in the wrong order is one of the more common causes of a PC ending up with no active real-time protection at all for a window of time. Restart when the installer asks you to.

Step 9: Verify Defender Dropped Into Passive Mode

This is the step most layered setups skip, and it is the one that actually confirms your configuration is safe rather than silently broken. After the restart, run:

Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, NISEnabled

With a third-party antivirus correctly installed, expect output like this:

AMRunningMode              : Passive
AntivirusEnabled           : True
RealTimeProtectionEnabled  : False
NISEnabled                 : False

AMRunningMode set to Passive is the state Microsoft’s own documentation describes when Smart App Control is active alongside a third-party engine: Defender keeps running for periodic scanning and threat intelligence, but it hands real-time protection duties fully to the other product. If AMRunningMode instead shows Normal with RealTimeProtectionEnabled set to True, you now have two real-time engines running at once, which is exactly the configuration Microsoft’s support guidance warns against, and you should open your third-party AV’s settings to confirm it actually took over real-time scanning.

Step 10: Add a Second-Opinion Scanner Without Conflicts

A second-opinion, on-demand scanner (something you run manually once a month, not a second always-on engine) is a different category from a second real-time antivirus, and it is generally safe to combine with whichever engine is handling real-time duties. The distinction that matters: an on-demand scanner should never offer, or should have declined, a persistent background shield during its own installation. If an installer asks whether to enable real-time protection and you already have Defender or another product handling that job, decline it for the second tool.

Step 11: Lock Down Sign-In With Windows Hello

Antivirus software stops malware, Windows Hello stops a stolen or phished password from being enough on its own to get into your account. In Windows Security, go to Account protection, then Windows Hello, and set up a PIN at minimum, plus fingerprint or facial recognition if your hardware supports it. This is not a replacement for the antivirus work in the previous steps, it is a separate layer against a completely different attack: someone who already has your password rather than someone trying to run malicious code on your machine.

Step 12: Turn On Controlled Folder Access for Ransomware Protection

Controlled Folder Access is a Defender feature that blocks unrecognized processes from writing to protected folders like Documents and Pictures, which is specifically useful against ransomware even when it is running alongside a third-party real-time engine. Enable it with:

Set-MpPreference -EnableControlledFolderAccess Enabled

Expect a handful of legitimate applications, especially less common photo editors or backup tools, to get blocked the first time they try to write to a protected folder. Add them individually through Windows Security’s Ransomware protection page rather than disabling the feature entirely.

Step 13: Test the Stack With the EICAR File and the Dashboard

The EICAR test file is an industry-standard, completely harmless text string that every legitimate antivirus engine is designed to flag as if it were a virus, specifically so you can safely confirm real-time protection is actually working. Create it locally and watch what happens:

Set-Content -Path "$env:TEMP\eicar-test.txt" -Value 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'

Whichever engine is handling real-time protection (Defender, or your third-party product per Step 9) should quarantine or delete the file within a few seconds of it being written to disk. If nothing happens, go back to Step 9 and recheck AMRunningMode and RealTimeProtectionEnabled before assuming you are protected. Finish by opening Windows Security’s full dashboard one more time and confirming every tile is green.

How Windows 11 Antivirus Products Scored in the August 2026 AV-TEST Round

AV-TEST’s independent lab runs monthly evaluations of antivirus products against three criteria, each scored out of 6: protection (detection of real-world and reference malware), performance (system slowdown), and usability (false positives). Here is how the Windows 11 home-user products tested in August 2026 scored, per AV-TEST’s published results, the same independent lab referenced earlier in this guide:

Product (version tested)	Protection /6	Performance /6	Usability /6
AhnLab V3 Internet Security 9.0	6	6	6
Avast Free Antivirus 26.6	6	6	6
AVG Antivirus Free 26.6 / 26.7	6	6	6
Avira Internet Security for Windows 1.1	6	6	6
Bitdefender Total Security 27.0	6	6	6
EnigmaSoft SpyHunter 5.22	5.5	6	6
ESET Security Ultimate 19.1 / 19.2	6	6	6
F-Secure Total 26.6	6	6	6
K7 Computing Total Security 16.0	6	6	6
Kaspersky Premium 21.24 / 21.25	6	6	6
Malwarebytes Premium 5.5 / 5.6	6	6	6
McAfee Total Protection 1.39	6	6	6
Microsoft Defender Antivirus (Consumer) 4.18	6	5.5	6
Norton 360 26.6 / 26.7	6	6	6
Protected.net TotalAV 6.6 / 6.7	6	5.5	6

The headline takeaway is how tight this field is. Thirteen of the fifteen products tested hit a perfect protection score, and the gaps that do show up are almost entirely in the performance column, meaning how much a product slows down everyday tasks like copying files or launching applications, rather than in raw detection. Microsoft Defender Antivirus for Windows 11 lost half a performance point in this round, the same half-point also lost by TotalAV, while every other product in the table posted a clean 6/6/6 or came within half a point of it.

Microsoft Defender vs Third-Party Antivirus on Windows 11: Which Should You Run

With the test data in hand, the decision from Step 4 usually comes down to factors AV-TEST does not measure at all.

Factor	Microsoft Defender only	Defender + third-party layer
Cost	Included with Windows 11, no extra charge	Usually a paid annual subscription
Setup complexity	Minimal, already configured out of the box	Requires passive-mode verification (Step 9)
Extra features	Firewall, Controlled Folder Access, SmartScreen	Often adds VPN, identity monitoring, parental controls
Central management	Built into Windows Security and Intune/Group Policy	Vendor’s own console, sometimes cloud-managed
August 2026 AV-TEST protection score	6/6	6/6 across nearly every tested vendor
Best fit	Most home users and small offices	Users who specifically want bundled extras

If your main motivation for a third-party product is a bundled VPN, identity-theft monitoring, or a parental-controls dashboard, buy it for those features with the expectation that its antivirus engine will perform comparably to Defender, not meaningfully better, based on the independent AV-TEST data above.

The Complete Project: A Windows 11 Security Baseline Checker Script

Rather than re-running each command from this tutorial by hand after every Windows update, save the following as a single script, SecurityBaselineCheck.ps1, and run it from an elevated PowerShell prompt whenever you want a full status report:

#Requires -RunAsAdministrator

Write-Host "=== Windows 11 Build ===" -ForegroundColor Cyan
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Write-Host "`n=== TPM and Secure Boot ===" -ForegroundColor Cyan
Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled
try {
    $secureBoot = Confirm-SecureBootUEFI
    Write-Host "Secure Boot Enabled: $secureBoot"
} catch {
    Write-Host "Secure Boot check failed: firmware may not be UEFI" -ForegroundColor Yellow
}

Write-Host "`n=== Core Isolation / Memory Integrity ===" -ForegroundColor Cyan
(Get-ComputerInfo).DeviceGuardSecurityServicesRunning

Write-Host "`n=== Smart App Control State ===" -ForegroundColor Cyan
$sac = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" `
    -Name "VerifiedAndReputablePolicyState" -ErrorAction SilentlyContinue
if ($sac) {
    Write-Host "VerifiedAndReputablePolicyState: $($sac.VerifiedAndReputablePolicyState)"
} else {
    Write-Host "Smart App Control not available on this installation" -ForegroundColor Yellow
}

Write-Host "`n=== Defender Status ===" -ForegroundColor Cyan
Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, `
    RealTimeProtectionEnabled, NISEnabled, AntivirusSignatureLastUpdated

Write-Host "`n=== Controlled Folder Access ===" -ForegroundColor Cyan
(Get-MpPreference).EnableControlledFolderAccess

Write-Host "`nBaseline check complete." -ForegroundColor Green

Run it with powershell -ExecutionPolicy Bypass -File .\SecurityBaselineCheck.ps1 from an elevated prompt. A healthy layered setup on a 25H2 machine with a third-party AV installed should produce a report ending in AMRunningMode: Passive, AntivirusEnabled: True, and RealTimeProtectionEnabled: False, exactly mirroring the Step 9 output above. A healthy Defender-only setup should instead show AMRunningMode: Normal with RealTimeProtectionEnabled: True.

Common Pitfalls When Layering Windows 11 Antivirus Protection

• Running two always-on real-time engines at once. This is the exact scenario Microsoft’s own support documentation warns against, and it causes file-lock conflicts, duplicate quarantines, and in some cases boot slowdowns severe enough to look like a hardware fault.
• Assuming Smart App Control can be switched on after an in-place upgrade. It cannot. Only a clean installation of Windows 11 offers the toggle, and no amount of searching in Windows Security will surface it on an upgraded machine.
• Never checking AMRunningMode after installing a third-party AV. Many users install a new antivirus, see its dashboard look healthy, and never confirm Defender actually stepped back, leaving them exposed to the double-engine conflict above without realizing it.
• Excluding entire folders from scanning to “fix” a performance complaint. A broad exclusion on a Downloads or Desktop folder removes protection from exactly the places malware most often lands first.
• Enabling Memory Integrity without checking driver compatibility first. Older peripheral and virtualization software drivers can fail Core Isolation’s integrity checks, which shows up as a boot loop or blue screen rather than a friendly warning.
• Treating Windows Hello as antivirus protection. A PIN or fingerprint sign-in stops credential theft, it does nothing against a malicious file that is already executing.
• Forgetting to re-verify after a feature update. Moving from 25H2 to 26H2 can reset some Defender preferences to default, so rerun the baseline script from the project section after any feature update.

Troubleshooting Windows 11 Antivirus Problems

• Windows Security shows “Actions recommended” after installing a third-party AV. Open the app, check Virus & threat protection, and confirm whether it is reporting on Defender (now inactive by design) or on the new product (which may need its own first scan).
• Get-MpComputerStatus returns AMRunningMode: NotRunning. This usually means Tamper Protection or a Group Policy setting disabled Defender entirely rather than placing it in passive mode, check Windows Security’s Virus & threat protection settings for a manually toggled-off switch.
• Smart App Control is greyed out with no toggle. Confirmed in Step 5, this means the feature is simply unavailable on an upgraded install, not broken, a clean reinstall is the only way to gain the option.
• Core Isolation’s Memory Integrity toggle is missing entirely. Confirm TPM 2.0 and Secure Boot from Step 2 are both enabled in firmware, this feature will not appear at all without them.
• The PC blue-screens shortly after enabling Memory Integrity. Boot into Safe Mode, disable Memory Integrity, and check Windows Security’s Core isolation page, which typically names the specific incompatible driver so you can update or remove it before re-enabling.
• A third-party antivirus installer finishes but Defender still shows as active. Reboot once more, then rerun the Step 9 command, some installers require the restart to actually complete the handoff.
• The EICAR test file is deleted by your browser download manager, not your antivirus. This is actually expected behavior in modern browsers and does not confirm your antivirus is working, create the file locally with the PowerShell command in Step 13 instead of downloading it.
• Scheduled scans spike CPU usage during work hours. Reschedule the full scan to overnight hours in Windows Security’s scan options, or in your third-party AV’s own settings if it is handling real-time duties.
• A legitimate application gets quarantined as a false positive. Submit it to Defender’s sample submission portal or your third-party vendor’s equivalent, then add a narrowly scoped, single-file exclusion rather than excluding its entire installation folder.

Advanced Tips for Power Users and IT Admins

Managed environments should configure this baseline through Group Policy or Microsoft Intune rather than by hand on each device, since Tamper Protection otherwise blocks remote changes to Defender settings for good reason. Attack Surface Reduction rules, configurable through the same Defender preferences covered in Step 7, add behavior-based blocking against common exploit techniques like Office macros launching child processes, and they stack safely with a third-party engine in passive mode because they operate at the kernel level rather than through Defender’s real-time scanning path. If you manage multiple machines, push the SecurityBaselineCheck.ps1 script from the project section through Intune’s script deployment feature on a weekly schedule and route the output to a shared log location rather than relying on each user to run it manually. Finally, if performance is the actual complaint driving someone toward exclusions, check CloudBlockLevel and scan scheduling in Step 7 before reaching for a folder exclusion, since the performance-score gaps in the August 2026 AV-TEST table above were measured without broad exclusions in place.

For readers managing a broader security stack, this kind of configuration discipline pairs naturally with locking down credentials. Our password manager setup tutorial and our 2FAS authenticator setup guide cover the identity side of the equation that Windows Hello only partially addresses, and if you would rather self-host your credential vault, our Vaultwarden self-hosting walkthrough is the next logical step. Readers comparing specific antivirus products feature by feature, rather than configuring what is already on their PC, can also check our separate antivirus software roundup, and IT teams tracking the vulnerability side of endpoint security should see our CVE patch pipeline tutorial for how to prioritize what to patch once antivirus and identity are both covered. For ongoing cybersecurity coverage on breaches, zero-days, and defensive tooling, our cybersecurity section tracks these stories as they develop.

Three Real-World Antivirus Configurations for Windows 11

Reading through thirteen steps can make the end goal feel abstract, so here is what the finished configuration actually looks like for three common situations.

1. The home user who wants a Defender-only setup. After Steps 1 through 3 confirm a current build and a healthy Windows Security dashboard, this reader skips straight to Step 6 (Core Isolation), Step 11 (Windows Hello), Step 12 (Controlled Folder Access), and Step 13 (the EICAR test), never touching a third-party installer. Running the baseline script from the project section afterward should show AMRunningMode: Normal with RealTimeProtectionEnabled: True, confirming Defender itself is doing the real-time work with no second engine involved.
2. The gamer or power user layering in a third-party suite for its VPN and identity features. This reader follows every step in order, paying particular attention to Step 8’s installation sequence and Step 9’s passive-mode verification, since gaming PCs are exactly the machines where an accidental double real-time scanner shows up as frame drops and stutter rather than an obvious error message. The CloudBlockLevel and exclusion tuning from Step 7 also matters more here, since game launchers and anti-cheat software are common sources of legitimate-but-flagged behavior.
3. The small office running a handful of Windows 11 PCs without a dedicated IT budget. Rather than configuring each machine by hand, this reader uses the SecurityBaselineCheck.ps1 script from the project section as a standardized check run on every PC after setup, and keeps a simple log of each machine’s AMRunningMode and Smart App Control state so a yellow warning on one PC gets caught before it becomes a wider incident. The advanced tips section below covers how to scale this further with Intune once the office grows past a handful of devices.

Frequently Asked Questions

Do I still need antivirus software if Microsoft Defender is built into Windows 11?
For most home users, no. Microsoft Defender Antivirus for Windows 11 scored a perfect protection rating in AV-TEST’s independent evaluations covered above, and Microsoft’s own guidance states that for many users its level of protection is plenty. A third-party product mainly adds extras like a bundled VPN or identity monitoring, not meaningfully stronger malware detection.

What happens to Microsoft Defender when I install a third-party antivirus on Windows 11?
Depending on whether Smart App Control is active, Defender either disables its real-time engine entirely or drops into passive mode, continuing to run for periodic scanning and threat intelligence while the new product handles real-time protection. Step 9 above shows exactly how to check which state you are in.

Can I enable Smart App Control after upgrading to Windows 11 26H2?
No. Microsoft’s documentation confirms Smart App Control can only be turned on during a clean installation. An in-place feature update to 26H2 will not add the toggle to a PC that did not already have it available.

Does Core Isolation’s Memory Integrity feature slow down Windows 11?
It adds a small, generally unnoticeable overhead for most modern hardware with current drivers. The real risk is compatibility, not raw speed, older or unsigned drivers can fail its integrity checks and cause boot problems, which is why Step 2’s TPM and Secure Boot check comes before enabling it.

How do I check which Windows 11 build and antivirus version I’m running?
Run the Get-ComputerInfo and Get-MpComputerStatus commands from Steps 1 and 9, or run the full SecurityBaselineCheck.ps1 script from the project section, which reports both in one pass.

Is it safe to run two antivirus programs at once on Windows 11?
Running two always-on, real-time scanning engines simultaneously is explicitly what Microsoft’s support documentation recommends against. Running one real-time engine alongside an on-demand, manually triggered second-opinion scanner, as described in Step 10, is a different and generally safe combination.

What is the difference between Windows 11 24H2, 25H2 and 26H2 for security updates?
All three branches currently receive monthly security servicing in parallel. The October 13, 2026 update, KB5127648, patched build 26100.9711 for 24H2, 26200.9711 for 25H2, and 26300.9711 for 26H2 at the same time, so the branch label matters less than confirming you are on the current build for whichever one you run.

How do I test whether my antivirus setup actually works?
Create the EICAR test string locally using the PowerShell command in Step 13 and confirm whichever engine is handling real-time protection quarantines it within seconds. Do not rely on downloading the file through a browser, since browser-level blocking is a separate mechanism from antivirus detection.

Related Coverage

• Best Python Code Editor 2026: Set Up in 12 Steps, 60 Min
• Best AI Code Editors 2026: Set Up in 12 Steps, 90 Min
• Windows 11 Emulator Setup: 13 Steps, 70 Minutes [2026]
• Cursor Cloud Agents Setup: 12 Steps, 60 Min [2026]
• Best Budget Smartphone Under 20000 [2026]: 10 Steps, 45 Min