After upgrading to Windows 10 version 1607 (known as “Anniversary Update” or “Redstone 1”) released in August 2016, some users are wondering if Windows Defender is running alongside their main antivirus program, as the icons for both programs are visible in the Notification area.
Isn’t Windows Defender supposed to turn itself off when it detects a 3rd party antivirus program in the system?
Windows Defender and Avast antivirus icons in the Notification area.
“Limited Periodic Scanning” enabled?
Yes. Windows Defender is designed to automatically turn itself off if you install another antivirus application. But, with the Windows 10 Redstone 1 (Anniversary Update), Windows Defender has a new opt-in feature called “Limited Periodic Scanning”, available for systems with a 3rd party antivirus program installed.
If Limited Periodic Scanning is turned on, Windows 10 will use the Windows Defender scanning engine to periodically scan your PC and eliminate threats, even if you’ve installed a 3rd party antivirus and using its real-time protection.
Limited periodic Scans will utilize Automatic Maintenance to ensure the system chooses optimal times based on minimal impact to the user as well as the system performance.
Automatic Maintenance tasks usually kick in after you leave the system idle for more than 5 minutes or so. That’s probably when the limited periodic scans take place. Limited Periodic Scanning doesn’t take care of real-time protection (as your primary antivirus program does that already) and it’s intended to offer an additional line of defense to your existing antivirus program’s real-time protection.
When you turn on Limited Periodic Scanning, it activates the Windows Defender Service along with its Early Launch Anti-Malware (ELAM) boot driver WdBoot.sys and Microsoft antimalware file system filter driver WdFilter.sys.
In the front-end, it adds the Windows Defender Notification area icon, which is what is causing a little bit of confusion for users. But if you hover the mouse pointer on the Defender icon, it clearly says:
PC Status: Windows Defender Periodic Scanning is ON
And the Windows Defender window would state “Real-time protection: Handled by another AV Program“.
Why “Limited Periodic Scanning”?
Per MMPC, Microsoft’s Malicious Software Removal Tool (MSRT) scans more than 500 million Windows devices for malware and malicious software every month. This tool aids in the detection and removal of malware from 1 to 2 million machines each time, *even on those devices running antivirus software*.
So, in < 0.4% of the cases, the primary antivirus program failed to nab malware in the first place. And thankfully, MSRT got them. That’s the reason they introduced Windows Defender Limited Periodic Scanning feature in Windows 10 for secondary scanning — to make it more secure. As of now, Limited Periodic Scanning is a Windows 10-only feature which is available if you upgrade to version 1607 (Anniversary Update).
And don’t forget the Windows Defender Offline scanning feature built-in to Windows 10. Windows Defender Offline and Limited Periodic Scanning are two useful features you can use even if you have a 3rd-party antivirus solution in place.
See also: MMPC blog post Limited Periodic Scanning in Windows 10 to Provide Additional Malware Protection.
About the author
Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.