Microsoft Defender Antivirus is built into Windows Server 2016 and later and into Windows 10/11. It is turned on by default, updates itself through Windows Update and is enough for most servers. Here is how to check it and use it well.
Check that Defender is running
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdatedAll three Enabled values should be True, and the signature date should be recent. On a server with a desktop you can also open Windows Security → Virus & threat protection.
Update signatures and scan
Update-MpSignature
Start-MpScan -ScanType QuickScanUse -ScanType FullScan for a complete scan. It takes much longer and uses more CPU, so run it outside busy hours.
See anything Defender has found:
Get-MpThreatDetectionUse exclusions carefully
Real-time scanning can slow down programs that write many small files, such as databases or build tools. Software vendors sometimes recommend excluding specific folders:
Add-MpPreference -ExclusionPath "D:\Data\SQL"
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathWarning: Exclude only folders a vendor documents, never whole drives or your Downloads folder. A file in an excluded folder is not scanned at all. Remove an exclusion with Remove-MpPreference -ExclusionPath.
Do you need another antivirus?
Usually not. If you install another antivirus product, Defender switches itself to passive mode on Windows 10/11. On Windows Server it does not always do this, so follow the other product's instructions to avoid two real-time scanners fighting over the same files.
Troubleshooting
- A trusted program was quarantined: open Windows Security → Protection history, check the item, and restore it only if you are certain it is safe.
- High CPU from "Antimalware Service Executable": usually a scan in progress; let it finish, or check Check CPU, RAM and disk use on Windows.