Technology Microsoft is moving antivirus programs from running at kernel level

[Gandalf_The_Grey]

Content source

https://www.ghacks.net/2025/06/27/microsoft-is-moving-antivirus-programs-from-running-at-kernel-level/

Antivirus software will soon be moved out of the kernel mode in Windows. This change is part of Microsoft's Windows Resiliency Initiative (WRI).

Last year, millions of Windows PCs crashed with a blue screen due to a faulty update for Crowdstrike. In the aftermath of the incident, Microsoft held a security summit with the intention to prevent such issues in the future. Several security vendors, including Bitdefender, CrowdStrike, ESET, SentinelOne, Trellix, Trend Micro, and WithSecure, joined the Microsoft Virus Initiative (MVI) 3.0 program to collaborate with Microsoft and improve the security and reliability of Windows.

Microsoft says that it will release a private preview of the Windows endpoint security platform to its MVI partners. The changes will require antivirus software, and endpoint detection and response (EDR) apps, to run in user mode like most apps do. Microsoft highlights that running apps with administrator permissions opens the door to malware, which could infect a user's computer, and wreak havoc on critical system resources, causing disruptions, data loss, etc. This was what had caused the Crowdstrike BSODs last year.

Security vendors will be able to test their software, and request changes if required, to ensure that their antivirus products run fine in user mode. The Verge quotes David Weston, vice president of enterprise and OS security at Microsoft, who said that "We’re not here to tell them how the API should work, we’re here to listen and provide the security and reliability".

Instead of laying down the rules, Microsoft is collaborating with antivirus vendors to share feedback and co-engineer the system. It could take a while to get things sorted with the previews, but this is a nice approach.

Weston also hinted that these changes could also affect kernel-level anti-cheat mechanisms used in games, Easy Anti-Cheat for example. It could be a thing of the past, which is welcome news.

Microsoft is moving antivirus programs from running at kernel level - gHacks Tech News

Antivirus software will soon be moved out of the kernel mode in Windows. This change is part of Microsoft's Windows Resiliency Initiative (WRI). ADVERTISEMENT Last year, millions of Windows PCs crashed with […]

www.ghacks.net

 

[Andy Ful]

If Microsoft is going to move AVs and anti-cheat software in user mode, what will happen to many security-related applications that currently use kernel drivers? This is an open question. However, nothing will probably change until Windows 12.

For decades, Microsoft has built Windows in a way that has allowed developers to deliver security software that’s deeply rooted into Windows, running at the kernel level of Windows — the core part of an operating system that has unrestricted access to system memory and hardware. The faulty CrowdStrike update last year highlighted just how easy it is for a kernel-level driver to go wrong and take down a machine, resulting in a Blue Screen of Death (BSOD).

 

[simmerskool]

wondering if this AV move will apply to MS Defender too, or if not, will MS claim "superiority" because MSD runs at a deeper level?

 

[KnownStormChaser]

I would love to see this apply to anti cheat software too, lol. It is just nothing but a pain currently. That will be the last major hurdle for Linux gaming if anti cheat software becomes a thing of the past.

 

[Parkinsond]

wondering if this AV move will apply to MS Defender too, or if not, will MS claim "superiority" because MSD runs at a deeper level?

Might be a move to circumvent other security solutions in favor of MD.

 

[TairikuOkami]

I recall times when Defender was the only 64-bit AV for years, other AVs refused to change.
They are in their comfort zone, they are being paid, so why make something better "for free"?

 

[Marko :)]

wondering if this AV move will apply to MS Defender too, or if not, will MS claim "superiority" because MSD runs at a deeper level?

Defender will for sure get an exception. Apple gets away with it, so why wouldn't Microsoft. Apple has guidelines for apps on the App Store, which don't apply to their own apps. They also restrict API access for various functions of their devices for 3rd party apps, but not for their own apps.

Might be a move to circumvent other security solutions in favor of MD.

Well... if Defender gets an exception, there's no doubt Microsoft will use it to gain more users.

 

[Parkinsond]

to gain more users

Not an unusual practice by MS

Redirecting

 

[TairikuOkami]

Not an unusual practice by MS

 

[BSONE]

Might be a move to circumvent other security solutions in favor of MD.

I dont think this is the case for the average Joe running Windows at home, as Microsoft gets no money from home users. I believe this move is about making windows more resilient and bullet proof.
That said, Business and Enterprise customers will be more likely to use Microsoft solutions as it is just "Easier". MS also benefits greatly from all the malware telemetry they recieve from home users.

 

[Parkinsond]

average Joe running Windows at home

Joe most proabably will prefer a 3rd party AV where it can easily manage quarantine.

I believe this move is about making windows more resilient and bullet proof

I believe it is about harvesting users data, rather than protecting them.

 

[BSONE]

Joe most proabably will prefer a 3rd party AV where it can easily manage quarantine.

I believe it is about harvesting users data, rather than protecting them.

Yes, they will probably be sucked into the likes of Norton or McAfee either from buying in store or preinstalled on laptop..

I believe it is about harvesting users data, rather than protecting them.

Yes, Microsoft, just like Google wants to make money from selling Ads, but they also have a vested interested in keeping their customers safe from Malware, as the big news and media corps today love reporting on breaches and hacks, which will have an effect on their share prices.

 

[Marko :)]

Average Joe currently uses Defender as his antivirus software. I'm yet to meet a person who uses 3rd party antivirus software today, let alone pays it.

 

[Parkinsond]

Average Joe currently uses Defender as his antivirus software

Average Joe has just told me using free 3rd party AV causes less pain than dealing to MD UI.

 

[Parkinsond]

Average Joe needs an "average" UI; definitely it is not MD UI.

 

[icotonev]

If Microsoft is going to move AVs and anti-cheat software in user mode, what will happen to many security-related applications that currently use kernel drivers? This is an open question. However, nothing will probably change until Windows 12.

That's right-this is one of the biggest questions in the whole initiative. If Microsoft really moves the antivirus solutions to User Mode, this will affect a wide range of applications that are currently relying on Kernel-Level drivers
The biggest challenge? Rootkit and Byovd (Bring Your Own VulneReila Driver) attacks. If the security software does not access the kernel, it will be more difficult to find and block such threats. On the other hand, limiting access to the nucleus can reduce the risk of collapses and vulnerabilities, as the Crowdstrike incident showed.

 

[Jonny Quest]

Average Joe needs an "average" UI; definitely it is not MD UI.

Especially the Windows Firewall. And some of the AV's right click system tray options are also a nice convivence.

 

[Parkinsond]

Especially the Windows Firewall. And some of the AV's right click system tray options are also a nice convivence.

Windows Firewall is even worse; needs a complete redesign.

 

[Marko :)]

Average Joe has just told me using free 3rd party AV causes less pain than dealing to MD UI.

Trust me—Average Joe never opens AV and he doesn't care how the "window" of AV software looks.

Average Joe needs an "average" UI; definitely it is not MD UI.

If your Average Joe knows how to install antivirus software, goes through its UI and settings, then this person isn't Average Joe. Because Average Joe doesn't know how to install a software, let alone how to configure it.

 

[anirbandutta01]

Several security vendors, including Bitdefender, CrowdStrike, ESET, SentinelOne, Trellix, Trend Micro, and WithSecure, joined the Microsoft Virus Initiative (MVI) 3.0 program to collaborate with Microsoft and improve the security and reliability of Windows.

Kaspersky?