Just the next step →

How to check Microsoft Defender protection on Windows 11

By Iikka Isosaari · Windows 11 · Updated September 26, 2026

Open Windows Security and review Virus & threat protection. Check the active protection provider, available protection status and recent findings. An enabled setting or a clean scan is useful evidence, not proof that a PC is threat-free.

Start with Windows Security

1. Search Start for Windows Security and open Virus & threat protection.
2. Review reported issues, protection updates and recent scan information.
3. Check protection settings and Protection history for information about detections and actions.
4. If you request a scan, distinguish the request being accepted from the scan finishing. Review its eventual result.

Microsoft’s protection guide explains scan options, settings and exclusions. Another installed antivirus or organizational policy can change the controls you see.

Understand missing or restricted information

Three states need different interpretations: a setting is enabled, a setting is disabled, or the tool could not read it. “Unknown” should not silently become “safe” or “unsafe.” Record the access or collection error and check the corresponding Windows Security view.

If an exclusions field says administrator access is required, the exclusions are unknown to that audit. It does not mean the list is empty. Run an elevated audit only when you need that additional visibility and are authorized to use it.

Exclusions intentionally omit selected targets from applicable scanning. An unfamiliar exclusion deserves investigation, but its presence alone is not a diagnosis. Do not add broad exclusions simply to make a warning disappear.

Read the audit in Hanki Shield

Open Shield → Defender audit. It starts with a plain-language summary of what Microsoft Defender reports, including real-time protection, tamper protection and how recently security intelligence was updated, with each area marked Good, Review or Problem. When exclusions need administrator access, the summary says so instead of reporting an empty list.

Below the summary, review reported protection separately from configured preferences. Settings with names beginning Disable are inverted: a false disable flag means that particular disabling preference is not set.

Use the raw evidence when a summary needs more context. Preserve collection errors in a report, and compare the result with Windows Security. Hanki’s scan controls request work from Microsoft Defender; Defender operates independently and may remediate according to Windows policy.

Hanki’s experimental standalone scanner is separate. It uses a test signature and simple heuristics, and does not replace Microsoft Defender or another maintained antivirus product.

Follow up on the specific finding

For a failed update or scan request, keep the exact error and time, then check the status in Windows Security. For a detection, inspect its protection-history details and action status rather than treating the number of findings as the whole story.

Before sharing, remove usernames, file paths and private content from the report. Never upload a suspicious file to a public support chat. Use GitHub issues for an app bug, with reproduction steps and reviewed diagnostic text.