How to Know If Windows Defender Is Really Active
Quick check, and the industry-standard test file to confirm it for certain.
Windows Defender is the antivirus built into Windows, and it's normally active with nothing needed from you. But "believing it's active" and "confirming it" are different things — here's how to check it for certain.
Quick check
- Search for "Windows Security" in the Windows search box.
- "Virus & threat protection".
- Look for "Real-time protection" — it should say "On".
If you have another antivirus installed (Avast, Norton, etc.), it's normal and expected for Windows Defender to show as off — it turns off automatically to avoid interfering with the other program, and only turns back on if you uninstall the other antivirus. It isn't a fault, it's the expected behaviour.
Checking the date of the last scan
On the same "Virus & threat protection" screen, the "Current threats" section shows when the last scan was and how many files it checked. A recent scan confirms Defender isn't just turned on, but actually working.
The most reliable check: the EICAR test file
EICAR is a completely harmless text file, created specifically by the security industry so any antivirus detects it as if it were a real threat — without being one. It's the standard way to check an antivirus genuinely responds, not just that it shows as "on" on a screen. You can search for "EICAR test file" to find the project's official source — if your antivirus flags it when you try to download or open it, that confirms it's working correctly.
Tip: if Windows Defender doesn't show up as available at all (not even the option to turn it on), and you don't have any other antivirus installed either, don't leave your machine unprotected — install an antivirus as soon as possible, even a free one, while you investigate why Defender isn't available.
Checking from Task Manager
Look for "Antimalware Service Executable" in the "Processes" tab — if it shows up running, that's another sign the service is active behind the scenes.
Frequently asked questions
Is it normal for Windows Defender to show as off if I have another antivirus?
Yes, completely normal. Windows Defender turns off automatically when it detects another installed antivirus, to avoid conflicts between the two, and only turns back on if you uninstall the other program.
What is the EICAR file and is it dangerous?
It's a harmless text file created by the security industry specifically so antiviruses detect it as a test, without being real malware. It's the standard, safe way to confirm an antivirus genuinely responds.
Do I need to do this check often?
There's no need to check it often if nothing has changed on your machine (you haven't installed or uninstalled another antivirus). It's worth checking if you notice something odd, or after installing or removing a security program.