Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
On a normal Windows 11 consumer PC, a compatible non-Microsoft antivirus that is installed, active, and up to date becomes the primary real-time antivirus. Microsoft Defender Antivirus normally steps aside automatically, while the Windows Security app remains as the dashboard that reports which provider is protecting the device. You can verify the active product at Windows Security > Virus & threat protection > Manage providers.
Do not run two full real-time antivirus engines together. Microsoft warns that overlapping products can reduce performance and cause update or software-installation errors. If the other antivirus expires, stops working, or is removed, Windows 11 can turn Defender back on.
As an Amazon Associate I earn from qualifying purchases.
What does “other antivirus providers” mean in Windows 11?
“Other antivirus providers” means non-Microsoft antivirus or antimalware software that has registered with Windows Security. The Windows Security app is not the scanning engine itself. It is the reporting and settings interface for antivirus providers, Microsoft Defender features, Windows Firewall, third-party firewalls, SmartScreen, and related protections.
That distinction explains a common source of confusion: you can still open Defender-related pages after installing another antivirus. The page belongs to the Windows Security dashboard, but the active real-time engine may be the third-party product listed under Manage providers.
Popular on Amazon
What happens to Microsoft Defender when another antivirus is installed?
When you install and turn on a compatible non-Microsoft antivirus, Windows 11 normally makes that product the primary real-time provider and places Microsoft Defender Antivirus in a non-primary state. Microsoft’s Windows 11 documentation says, “If you install and turn on another antivirus app, Microsoft Defender Antivirus turns off automatically.”
Microsoft also describes this consumer behavior as disabled mode for Windows 10 and Windows 11 devices that are not onboarded to Microsoft Defender for Endpoint. Defender is still part of Windows, but it is not responsible for continuous real-time remediation while the other provider is working.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The change is automatic; you generally do not need to edit the registry or disable Windows services. Windows Security continues to display the third-party provider, firewall status, SmartScreen, and other security controls. A Defender page remaining visible does not, by itself, prove that Defender is the active scanner.
How do I check which antivirus Windows 11 is using?
The Manage providers page is the authoritative place to identify the registered antivirus provider on a consumer PC.
- Open Windows Security from the Start menu, or open Settings > Privacy & security > Windows Security.
- Select Virus & threat protection.
- Under Who’s protecting me?, select Manage providers.
- Read the Antivirus entry. Use its button to open the active provider’s application or settings.
Check the status after installing, updating, or removing security software. If the provider shown there is current and reporting normally, that is the product Windows Security has registered as primary. If the page reports no active provider, update or repair the installed antivirus rather than turning off Windows Security components.
Can I run Microsoft Defender and another antivirus together?
Microsoft recommends that you do not run two products that both provide continuous real-time antivirus or antispyware protection. Two engines can inspect the same files and processes, compete for system resources, lock files while updates are being installed, and produce installation or update errors.
Also popular on Amazon
Choose one real-time antivirus as the primary provider. A second tool can be used only when it operates as an on-demand scanner: it runs when you start or schedule a scan instead of continuously intercepting files, downloads, and processes. Microsoft gives Microsoft Safety Scanner and Defender Offline as examples of scanners that can coexist because they run only when requested or scheduled.
This distinction matters for gaming PCs. A second real-time engine does not provide a guaranteed security improvement and can add background file inspection while a game, launcher, shader compiler, or anti-cheat component is updating. Keep one current real-time provider and use an on-demand scanner for a separate check when there is a specific reason.
What is limited periodic scanning, and should I enable it?
When another antivirus is registered and working, Windows Security may show Microsoft Defender Antivirus options below the non-Microsoft provider. One available option is limited periodic scanning.
Limited periodic scanning is not a second full antivirus. Microsoft says it uses only a small part of Defender, has limited reporting, and “can’t detect most malware or unwanted software.” It should therefore be treated as a supplementary, narrow check rather than an additional real-time defense or an independent replacement for the active provider.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a home PC, enabling the option is a choice, not a requirement. The trade-off is extra occasional Defender activity without the coverage or reporting of a complete primary installation. Microsoft does not support limited periodic scanning as an enterprise strategy and advises organizations to select one antivirus product and use it alone.
What is the difference between disabled mode, passive mode, and EDR Block Mode?
These labels describe different Defender states, and the distinction is important because enterprise documentation does not map perfectly onto a typical consumer PC.
Also popular on Amazon
| State | Where it generally applies | What Defender does |
|---|---|---|
| Disabled mode | Windows 10 or Windows 11 devices without Microsoft Defender for Endpoint when a compatible non-Microsoft antivirus is primary | Defender is automatically disabled as the primary real-time antivirus. |
| Passive mode | Devices onboarded to Microsoft Defender for Endpoint with another antivirus selected as primary | Defender may still scan files and report detections, but it does not take primary remediation responsibility. |
| EDR Block Mode | A Microsoft Defender for Endpoint state shown by Defender status reporting | The status value indicates a separate endpoint-detection configuration, not ordinary consumer antivirus operation. |
Passive mode normally requires Microsoft Defender for Endpoint onboarding, another antivirus as primary, Defender installed, and the Windows Security Center Service enabled. Windows 11 Smart App Control can also produce a passive-mode display in some situations; Microsoft cautions that this is not the same as enterprise Defender for Endpoint passive mode.
Administrators can inspect the Defender state with PowerShell:
Free tools Windows power users keep installed
One-click scans. No signup required.
Get-MpComputerStatus | Select AMRunningModePossible values documented by Microsoft include Normal, Passive, and EDR Block Mode. Consumer users should not force an enterprise passive-mode configuration with registry changes simply to imitate another status label.
What happens if the other antivirus expires, stops working, or is removed?
Windows 11 is designed to avoid leaving a device without a registered real-time provider. Microsoft says Defender can turn on when no other antivirus is installed and can re-enable if the third-party product is out of date, expired, or no longer working.
That recovery can occur after a subscription expires, an application is damaged, its real-time protection is switched off, or the program is uninstalled. The exact timing depends on Windows and the provider’s registration status, so verify the result instead of assuming the transition completed.
After removing the other antivirus, restart if its uninstaller requests it. Then open Windows Security > Virus & threat protection > Manage providers and confirm that Microsoft Defender Antivirus is active. If neither product reports protection, update or repair the remaining installation and resolve that state before downloading files or signing into sensitive accounts.
Also popular on Amazon
Why should I avoid disabling the Windows Security Center Service?
The Windows Security Center Service registers and reports security-provider status. Disabling it does not disable Microsoft Defender or Windows Firewall. Instead, it can make Windows Security display stale or inaccurate information and may prevent Defender from enabling itself when a third-party product becomes outdated or is removed.
Microsoft warns that suppressing the service can significantly reduce protection and contribute to malware infection. If a notification appears stuck after an antivirus change, use the provider’s uninstaller, reboot, update Windows, and recheck Manage providers. Do not hide the warning by disabling the service.
How can I fix a conflict involving one trusted file or program?
If a trusted file, folder, file type, or process is being detected incorrectly, adding a narrowly scoped exclusion is safer than turning off all antivirus protection.
- Open Windows Security.
- Go to Virus & threat protection > Manage settings.
- Scroll to Exclusions and select Add or remove exclusions.
- Add only the specific file, folder, file type, or process that is trusted and necessary.
- Remove the exclusion as soon as the underlying compatibility issue is resolved.
An exclusion reduces Microsoft Defender’s real-time coverage for that item. Scheduled Defender scans or a separate antivirus may still inspect it, but an exclusion is not risk-free. Never exclude an entire drive or broad system directory to solve an unclear alert; identify the exact path and verify the file’s source first.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Which Windows 11 protections remain when another antivirus is primary?
Changing the primary antivirus does not remove every Windows security layer. Windows 11 includes protections that are separate from the choice of real-time antivirus, including:
- Microsoft Defender SmartScreen, which helps block phishing pages, malicious websites, dangerous downloads, and untrusted applications.
- Network protection, which helps prevent connections to known malicious destinations.
- Tamper protection, which helps stop malicious changes to Defender security settings.
- Controlled folder access, which protects selected folders from unauthorized changes by applications.
- Exploit protection, which applies mitigation settings to Windows and selected programs.
The active third-party antivirus does not automatically replace these Windows features. Review their status in Windows Security, especially after installing security software that adds its own firewall or web-filtering components.
Also popular on Amazon
What should gamers check after switching antivirus providers?
Do not judge the result only by whether a game launches. Confirm that one provider is active, current, and reporting normally, then test the specific game launcher or anti-cheat update that previously caused trouble.
- Open Manage providers and verify one primary antivirus.
- Check that the provider’s subscription or license has not expired.
- Install pending antivirus and Windows updates before starting a long game session.
- If a launcher or anti-cheat file is flagged, verify its source and use a narrow exclusion only when necessary.
- Avoid enabling a second real-time engine to chase a performance or detection concern; use an on-demand scan instead.
No general performance percentage can be promised for one provider versus another. System load varies with the game, storage, update activity, scan settings, and hardware. The reliable rule is to eliminate overlapping real-time engines and then troubleshoot the individual conflict.
What is the safest setup for a Windows 11 consumer PC?
For most home users, the safest arrangement is one compatible, up-to-date real-time antivirus registered as primary, with Windows Security and its other protections left enabled. Use a second product only as an on-demand scanner, and keep limited periodic scanning in perspective because it is incomplete and has limited reporting.
When a provider is changed, verify the status in Manage providers after installation and again after removal or expiry. If the other product fails, Windows 11 may restore Defender automatically; confirm that handoff rather than assuming it occurred. Enterprise administrators should follow Defender for Endpoint guidance instead of applying consumer troubleshooting steps to passive-mode deployments.
Frequently Asked Questions
Is Windows Security itself an antivirus program?
Windows Security is the Windows interface that reports antivirus, firewall, SmartScreen, and related security status. The scanning engine is Microsoft Defender Antivirus or another provider registered with the system, so opening the app does not tell you which engine is primary until you check Manage providers.
Can an on-demand scanner be used with a third-party antivirus?
Yes, when it does not provide simultaneous real-time protection. A scanner that runs only when you start or schedule it, such as Microsoft Safety Scanner or Defender Offline, can be used for a second opinion without creating the constant engine overlap Microsoft warns about.
Recommended Free Tools
Why did Defender turn on after my antivirus subscription ended?
Windows monitors whether a registered provider is current and functioning. If the other product expires, is out of date, or stops supplying real-time protection, Windows can re-enable Defender so the device is not left without a primary antivirus.
Does enterprise passive mode apply to my personal Windows 11 PC?
Usually not. Passive mode is tied to Microsoft Defender for Endpoint onboarding and enterprise management requirements; an unmanaged consumer PC normally shows Defender in disabled mode when another compatible antivirus is primary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
