# Defender and SmartScreen on Windows 11: is the default enough?

> How Microsoft Defender, SmartScreen, reputation and controlled folder access work together, when a third-party AV makes sense, and why stacking antivirus is a bad idea.

**Tested on**

- Build: 26300.9457
- Edition: Home / Pro
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

For most home users, **yes, the default is enough**: Defender antivirus + SmartScreen + Windows Update + a non-admin daily account. Adding a second real-time antivirus usually adds conflicts, not protection.

A third-party AV can make sense for a specific feature, enterprise management or a bundled licence you already pay for. Then **disable Defender’s real-time protection through the proper registration**, not by stacking two scanners.

## The layers

| Layer | What it does | Default |
|---|---|---|
| Defender antivirus | Files, processes, behaviour, cloud protection | On |
| SmartScreen | App/web reputation, blocked downloads | On |
| Windows Update | Patches the OS and Defender platform | On |
| Firewall | Network exposure | On |
| Controlled folder access | Blocks unauthorised writes to protected folders | Optional |
| UAC | Admin consent | On |
| Smart App Control | Reputation-based app blocking on new installs | May be on/off depending on state |

No single layer stops everything. The goal is not “install more scanners”; it is “keep the layers working and reduce the attack surface”.

## Check the state

```powershell
Get-MpComputerStatus |
  Select-Object AntivirusEnabled, RealTimeProtectionEnabled,
    AntivirusSignatureVersion, AntivirusSignatureLastUpdated
```

```powershell
Get-MpPreference |
  Select-Object DisableRealtimeMonitoring, MAPSReporting,
    SubmitSamplesConsent, EnableControlledFolderAccess
```

If `AntivirusEnabled` is False, find out why before installing another product. A third-party AV may have registered itself and disabled Defender; that is expected. A broken registration is not.

## SmartScreen

SmartScreen checks the reputation of downloaded files and sites. It is not a full antivirus and it is not infallible.

- Keep it on for apps and Edge/Chrome.
- “Run anyway” is a decision, not a reflex. Check the publisher/signature and hash.
- A signed installer can still be malicious if the publisher is malicious; reputation is a signal, not proof.

## Controlled folder access

This blocks unauthorised processes from writing to Documents/Pictures/etc. It is useful against ransomware, but it can break legitimate apps. If you enable it:

1. Turn it on in Windows Security.
2. Add only the apps that need write access.
3. Test your backup and game save paths.
4. Do not add entire drives or `C:\` to the allow list.

## Third-party AV: the only sane rule

**One real-time antivirus at a time.** When you install a third-party AV, let it register with Windows Security and disable Defender’s real-time protection through that registration. Do not run two real-time scanners and hope they cooperate.

Also:

- Do not use “AV cleaner” tools that force-uninstall Defender.
- Do not download a “Defender disabler” from a random site.
- Do not rely on an AV to compensate for pirated software or cracked DLLs.

## False positives

If Defender flags a tool you trust:

1. Confirm the file hash and publisher.
2. Submit it to Microsoft as a false positive if appropriate.
3. Add a **narrow** exclusion only for that file/folder, and remove it later.
4. Never exclude `C:\`, your whole user profile or a downloads folder.

## Sources

- [Microsoft — Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows)
- [Microsoft — SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
- [Microsoft — Controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folders)

---

Source: https://windows.homes/en/windows/security/defender/