Why Is Windows Defender Running Alongside my Antivirus Program?

Is Windows Defender running alongside their main antivirus program, as the icons for both programs are visible in the Notification area? Isn’t Windows Defender supposed to turn itself off when it detects a third-party antivirus program?

Windows Defender and Avast antivirus icons in the Notification area.

“Limited Periodic Scanning” enabled?

Yes. Windows Defender is designed to turn itself off automatically if you install another antivirus application. However, a new opt-in feature, “Limited Periodic Scanning,” is available for Windows 10 and 11 systems with a third-party antivirus program installed and registered with Windows Security.

If “Periodic Scanning” is turned on, Windows will use the Windows Defender scanning engine to periodically scan your PC and eliminate threats, even if you’ve installed a third-party antivirus and are using its real-time protection.

Limited periodic Scans will utilize Automatic Maintenance to ensure the system chooses optimal times based on minimal impact to the user as well as the system performance.

Automatic Maintenance tasks usually kick in after you leave the system idle for more than 5 minutes or so. That’s probably when the limited periodic scans take place.  Limited Periodic Scanning doesn’t take care of real-time protection (as your primary antivirus program does that already) and it’s intended to offer an additional line of defense to your existing antivirus program’s real-time protection.

Turning on Limited Periodic Scanning activates the Windows Defender Service and its Early Launch Anti-Malware (ELAM) boot driver WdBoot.sys and Microsoft antimalware file system filter driver WdFilter.sys.

On the front end, it adds the Windows Defender Notification area icon, which is causing a little bit of confusion for users.

Related: Windows Security Icon Missing from Tray and the Task Manager Startup Tab

Why “Limited Periodic Scanning”?

Per MMPC, Microsoft’s Malicious Software Removal Tool (MSRT) scans over 500 million Windows devices for malware and malicious software every month. This tool aids in detecting and removing malware from 1 to 2 million machines each time, even on those devices running antivirus software.

So, in < 0.4% of the cases, the primary antivirus program failed to nab malware in the first place. And thankfully, MSRT got them. That’s the reason they introduced the Windows Defender Limited Periodic Scanning feature for secondary scanning — to make it more secure.

And don’t forget the Windows Defender Offline scanning feature built-in to Windows 10 and 11. Windows Defender Offline and Limited Periodic Scanning are two useful features you can use even if you have a 3rd-party antivirus solution in place.