Question Does MD on Win 11 update even if there's another antivirus installed?

Please provide comments and solutions that are helpful to the author of this topic.

rhythm

Level 11
Thread author
Apr 13, 2023
504
I configured my Windows Update to "notify for download". WD updates are showing up even though there's a third-party antivirus installed. Windows Security reports the activation of the third-party antivirus.

Does Windows Defender on Windows 11 update even if there's another antivirus installed?
 

Bot

AI-powered Bot
Verified
Apr 21, 2016
2,931
I configured my Windows Update to "notify for download". WD updates are showing up even though there's a third-party antivirus installed. Windows Security reports the activation of the third-party antivirus.

Does Windows Defender on Windows 11 update even if there's another antivirus installed?
Yes, Windows Defender on Windows 11 will still receive updates even if there is another antivirus installed on your system. This is because Windows Defender is integrated into the operating system and is designed to provide additional layers of protection, even if a third-party antivirus is installed.

However, Windows Defender will not actively scan your system if it detects that another antivirus is installed and running. The third-party antivirus will take precedence and Windows Defender will operate in a limited mode known as "passive mode".

So, if you are receiving updates for Windows Defender despite having a third-party antivirus installed, it's likely because these updates are designed to enhance Windows Defender's overall functionality and not to interfere with your existing antivirus software.
 

TairikuOkami

Level 34
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,379
This actually concerns me lately. Where does Defender end and System Guard begin? There was an article, that LSA issue was fixed with Defender's update. Now that would be a problem, if Defender was really disabled? The issue was fixed for me, so I guess it was included in the normal update, still it puzzles me, whether I should keep it enabled or not for OS updates?!
 
Last edited:

rhythm

Level 11
Thread author
Apr 13, 2023
504
What are the steps to disable Windows Defender? Despite disabling Tamper Protection and turning off Defender in Group Policy, it reverted to default after a system restart. Is it advisable to turn it off in Services?
 
  • Like
Reactions: Sorrento and BryanB

TairikuOkami

Level 34
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,379
Is it advisable to turn it off in Services?
If you want it to stay off, then yes. Basically those:
Code:
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
 

rhythm

Level 11
Thread author
Apr 13, 2023
504
What are the steps to disable Windows Defender? Despite disabling Tamper Protection and turning off Defender in Group Policy, it reverted to default after a system restart. Is it advisable to turn it off in Services?
I turned off Defender.

1. Turn off real-time protection, cloud, sample submission, and tamper protection in Windows Security.
2. Run Task Scheduler (run as administrator) and disable the tasks in MicrosoftWindows Defender.
3. Turn off real-time protection and turn off Defender in Group Policy.

Restart the system. Windows Security displays "no action needed", but inside it states "managed by your organization" with settings turned off.
 

Ink

Administrator
Verified
Staff Member
Well-known
Jan 8, 2011
22,285
Honestly, installing a third party AV on Windows 11 these days just feels like adding bloatware.
Look at all the features you’re missing out on! Is not paying us $79.99 annual subscription for your security and privacy not important to us you? /s
Complete Real-Time Data Protection
Network Threat Prevention
Advanced Threat Defense
Multi-Layer Ransomware Protection
Vulnerability Assessment
Web Attack Prevention
Anti-Phishing
Anti-Fraud
Rescue Environment
Antispam
Autopilot
Cloud Engine
Global Protective Network
Game, Movie and Work Modes
Speed Up Your Devices
Battery Mode
Unlimited VPN Traffic
Anti-tracker
Microphone Monitor
Webcam Protection
Safe Online Banking
Parental Control
Privacy Firewall
Anti-Theft
Wi-Fi Security Advisor
Social Network Protection
Password Manager
File Shredder
Real-Time Fraud Monitoring
Breach Monitor
Credit Report Monitoring
Dark Web Monitoring and Alerts
SSN Tracker
Fraud Alert Reminders
Identity Alert
Fraud Alert
Social Media Identity Monitoring
Credit Reports and Scores
Credit Freeze & Credit Report Fraud Assistance
Lost Wallet Assistance
Junk Mail Opt-Out
Medical ID Fraud Protection
White-Glove Restoration
Identity Theft Insurance - Up to $2 million
Multiple Bureau Credit - Up to 3 bureaus
Investment Account Alerts
Change of Address
Court Records Monitoring
Sex Offender Registry Monitoring
Cyberattacks reimbursement
 

rhythm

Level 11
Thread author
Apr 13, 2023
504
You can't fully disable Defender on Windows 11 with Group Policy or third-party antivirus. It still updates through Windows Updates and scans occasionally. If you fully turn off Defender or Firewall, the notification options vanish from Windows Security Settings. When I disabled the Firewall using Group Policy, I observed this. I used DefenderControl (Sordum) to turn off Defender, and its notification options vanished. There are no more Defender updates via Windows Updates or occasional scans.
 

rhythm

Level 11
Thread author
Apr 13, 2023
504
I checked the kids' systems with Kaspersky. The September Tuesday Patch appears to have updated the Defender behavior. Before, you couldn't stop the WinDefend Service, and Defender would update and scan. But now the systems have the WinDefend Service stopped and set to manual. And it has also stopped Defender updates since the September Patch. That's great!

I have Comodo Firewall on my system but no AV. I can't disable the WinDefend Service. So, I used DefenderControl to fully disable Defender.
 

Shadowra

Level 31
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,049
Basically, MS Defender continues to download its virus definitions to guarantee a protected system if you decide to uninstall your current antivirus.
Personally, I don't mind this at all. Even if Microsoft doesn't completely disable Defender...

Be careful with DefenderControl, MS Defender tries to activate itself if you don't have antivirus software, and this can corrupt antivirus files... But it will remain deactivated since you have Kaspersky.
 

rhythm

Level 11
Thread author
Apr 13, 2023
504
Basically, MS Defender continues to download its virus definitions to guarantee a protected system if you decide to uninstall your current antivirus.
Personally, I don't mind this at all. Even if Microsoft doesn't completely disable Defender...

Be careful with DefenderControl, MS Defender tries to activate itself if you don't have antivirus software, and this can corrupt antivirus files... But it will remain deactivated since you have Kaspersky.
It seems like the definitions downloading behavior has changed or stopped with a third-party AV installed. I will monitor it and provide an update later.

I had no problems using DefenderControl for a long time. I used it with Comodo Firewall and no AV. However, I stopped using it because the developer stopped supporting it. Now, I'm using DefenderControl again. I'll keep an eye out for any issues with Defender and will update here.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top