Why Is Windows Defender Running Alongside my Antivirus Program?

After upgrading to Windows 10 version 1607 (known as “Anniversary Update” or “Redstone 1”) released in August 2016, some users are wondering if Windows Defender is running alongside their main antivirus program, as the icons for both programs are visible in the Notification area.

Isn’t Windows Defender supposed to turn itself off when it detects a 3rd party antivirus program in the system?

Windows Defender and Avast antivirus icons in the Notification area.

“Limited Periodic Scanning” enabled?

Yes. Windows Defender is designed to automatically turn itself off if you install another antivirus application. But, with the Windows 10 Redstone 1 (Anniversary Update), Windows Defender has a new opt-in feature called “Limited Periodic Scanning”, available for systems with a 3rd party antivirus program installed.

If Limited Periodic Scanning is turned on, Windows 10 will use the Windows Defender scanning engine to periodically scan your PC and eliminate threats, even if you’ve installed a 3rd party antivirus and using its real-time protection.

Limited periodic Scans will utilize Automatic Maintenance to ensure the system chooses optimal times based on minimal impact to the user as well as the system performance.

Automatic Maintenance tasks usually kick in after you leave the system idle for more than 5 minutes or so. That’s probably when the limited periodic scans take place.  Limited Periodic Scanning doesn’t take care of real-time protection (as your primary antivirus program does that already) and it’s intended to offer an additional line of defense to your existing antivirus program’s real-time protection.

When you turn on Limited Periodic Scanning, it activates the Windows Defender Service along with its Early Launch Anti-Malware (ELAM) boot driver WdBoot.sys and Microsoft antimalware file system filter driver WdFilter.sys.

In the front-end, it adds the Windows Defender Notification area icon, which is what is causing a little bit of confusion for users. But if you hover the mouse pointer on the Defender icon, it clearly says:

PC Status: Windows Defender Periodic Scanning is ON

Related article: How to Remove Windows Defender Icon from Notification area in Windows 10?

And the Windows Defender window would state “Real-time protection: Handled by another AV Program“.

Why “Limited Periodic Scanning”?

Per MMPC, Microsoft’s Malicious Software Removal Tool (MSRT) scans more than 500 million Windows devices for malware and malicious software every month. This tool aids in the detection and removal of malware from 1 to 2 million machines each time, *even on those devices running antivirus software*.

So, in < 0.4% of the cases, the primary antivirus program failed to nab malware in the first place. And thankfully, MSRT got them. That’s the reason they introduced Windows Defender Limited Periodic Scanning feature in Windows 10 for secondary scanning — to make it more secure. As of now, Limited Periodic Scanning is a Windows 10-only feature which is available if you upgrade to version 1607 (Anniversary Update).

And don’t forget the Windows Defender Offline scanning feature built-in to Windows 10. Windows Defender Offline and Limited Periodic Scanning are two useful features you can use even if you have a 3rd-party antivirus solution in place.

See also: MMPC blog post Limited Periodic Scanning in Windows 10 to Provide Additional Malware Protection.