Windows Defender (also known as Windows Security) is a virus protection and security software provided by Microsoft, designed to protect the Windows operating system from malware such as viruses, spyware, and other harmful programs.

It is built into all the latest versions of Windows, such as Windows 10 and Windows 11, providing real-time protection without the need for the user to install third-party antivirus software.

Windows Defender protects your device in many ways.

Windows Defender scans files and programs in real-time as they are opened or executed, preventing malware from entering the system.

When the user opens, downloads, or executes files, Windows Defender automatically checks them for malware. It utilizes an extensive malware definition database that is constantly updated to ensure that it recognizes the latest threats. Defender can also use heuristic analysis and machine learning to identify new, unknown threats based on their behavior.

Real-time protection also includes network protection, which prevents dangerous websites from downloading malware or tricking users into providing their personal information (phishing). It warns users when they try to access known dangerous sites.

Voluntary cloud-based security utilizes cloud-based analytics to identify and prevent the latest threats.

Restricted access to folders (Controlled folder access)

"Controlled Folder Access" is a security feature that is part of Windows Defender's malware protection. This feature provides additional protection for sensitive files and folders by specifying which applications can make changes to the controlled folders. Its main goal is to protect data from ransomware and other malicious applications that attempt to modify files without permission.

When "Controlled Folder Access" is enabled, Windows Defender monitors selected folders and prevents suspicious or unknown applications from modifying files in these folders. The user or system administrator can specify which folders are protected and can also allow trusted applications access to these folders.

Write "Windows Security" in the Windows search bar and open the application. You can also find it by selecting Settings > Update & Security > Windows Security.

Open "Virus & Threat protection" from the left pane and check that "Real-time protection" is turned on.

Switch the "Real-time protection" to "On".

You can now voluntarily add directories you want to protect by selecting "Protected folders".

Performing a manual check with Windows Defender

Go to the section "Protection against viruses and threats" and select "Scan options". Here you can choose quick scan, full scan, or custom scan (scanning of specific folders).

The lab takes a couple of minutes to start up, please wait patiently and add more time if needed. You don't need to close the lab between switching modules in this course. You can log in to the server via RDP with the username "

Windows practice

Enable real-time protection of Windows Defender. Once done, run Check.ps1 and enter flag 3.

## What is Windows Defender?

Windows Defender (also known as Windows Security) is a virus protection and security software provided by Microsoft, designed to protect the Windows operating system from malware such as viruses, spyware, and other harmful programs.

It is built into all the latest versions of Windows, such as Windows 10 and Windows 11, providing real-time protection without the need for the user to install third-party antivirus software.

![](sanity:image-5c982f0060ae6bc8fa27b8997167641e29bfc8d2-1024x1024-png)

---

## What does Windows Defender do?

Windows Defender protects your device in many ways.

### Real-time protection

Windows Defender scans files and programs in real-time as they are opened or executed, preventing malware from entering the system.

When the user opens, downloads, or executes files, Windows Defender automatically checks them for malware. It utilizes an extensive malware definition database that is constantly updated to ensure that it recognizes the latest threats. Defender can also use heuristic analysis and machine learning to identify new, unknown threats based on their behavior.

### Network Security

Real-time protection also includes network protection, which prevents dangerous websites from downloading malware or tricking users into providing their personal information (phishing). It warns users when they try to access known dangerous sites.

### **Cloud-based protection**

Voluntary cloud-based security utilizes cloud-based analytics to identify and prevent the latest threats.

### **Restricted access to folders (Controlled folder access)**

"Controlled Folder Access" is a security feature that is part of Windows Defender's malware protection. This feature provides additional protection for sensitive files and folders by specifying which applications can make changes to the controlled folders. Its main goal is to protect data from ransomware and other malicious applications that attempt to modify files without permission.

When "Controlled Folder Access" is enabled, Windows Defender monitors selected folders and prevents suspicious or unknown applications from modifying files in these folders. The user or system administrator can specify which folders are protected and can also allow trusted applications access to these folders.

---

## Windows Defender Management

### Opening Windows Security

Write "Windows Security" in the Windows search bar and open the application. You can also find it by selecting Settings > Update & Security > Windows Security.

![](sanity:image-eeff107a19bf90af699c1006629d14f31952004b-970x352-png)

### Checking the status of Windows Defender

Open "Virus & Threat protection" from the left pane and check that "Real-time protection" is turned on.

![](sanity:image-47c3f23f2d938469a6e18c3b152c22c5defc4e63-1674x1078-png)

### Turning on Real-Time Protection

Switch the "Real-time protection" to "On".

![](sanity:image-dcec83fab935cae308125defe8bd95e6e90953db-1058x352-png)

### Enabling Restricted Directories

![](sanity:image-ccb5ef73c29ee89cace738461b9b6029a3cdb194-1068x284-png)

![](sanity:image-8e0d11fe15a6eab5365aa855d67d7fe9190efa52-1732x406-png)

You can now voluntarily add directories you want to protect by selecting "Protected folders".

![](sanity:image-430f0e6fdffa9af3df9ac02a674bb5d8df86065f-1098x702-png)

---

## Performing a manual check with Windows Defender

Go to the section "Protection against viruses and threats" and select "Scan options". Here you can choose quick scan, full scan, or custom scan (scanning of specific folders).

![](sanity:image-524ad8006735ad09773307b1ee3c76a5cbbc847e-1282x464-png)

![](sanity:image-dffa969217c8898ef05e78261982e8b7430772ca-1232x660-png)

![](sanity:image-ea5fc7679d2b24c6fc4e97b8acff5028c55c9baf-806x220-png)

---

## Tasks

@exercise 87113c414c3c

### Enable real-time protection

Enable real-time protection of Windows Defender. Once done, run Check.ps1 and enter flag 3.

@exercise 4002208b9700


Windows Defender Antivirus

In this course, we go through the basics related to managing Windows systems and maintaining information security.

In this course, we will go through the basics of Windows system administration and cybersecurity maintenance.

We familiarize ourselves with Windows virus protection, firewall, and automatic updates. We learn to use remote desktop connections, registry editor, PowerShell, server manager, and group policies.

The course does not go into great depth on Windows domains, attacks on them, or hardening. These more advanced topics are covered in the "Windows - Attack and Defense" course.

Windows Defender Antivirus

What is Windows Defender?

Learn to hack — start here