Why Is Windows Defender Running Alongside my Antivirus Program?

Is Windows Defender running alongside their main antivirus program, as the icons for both programs are visible in the Notification area? Isn’t Windows Defender supposed to turn itself off when it detects a third-party antivirus program?

windows defender limited periodic scanning
Windows Defender and Avast antivirus icons in the Notification area.

“Limited Periodic Scanning” enabled?

Yes. Windows Defender is designed to turn itself off automatically if you install another antivirus application. However, a new opt-in feature, “Limited Periodic Scanning,” is available for Windows 10 and 11 systems with a third-party antivirus program installed and registered with Windows Security.

Limited periodic scanning - Defender settings - Windows 11
Limited periodic scanning – Windows 11 screenshot

If “Periodic Scanning” is turned on, Windows will use the Windows Defender scanning engine to periodically scan your PC and eliminate threats, even if you’ve installed a third-party antivirus and are using its real-time protection.

Limited periodic Scans will utilize Automatic Maintenance to ensure the system chooses optimal times based on minimal impact to the user as well as the system performance.

Automatic Maintenance tasks usually kick in after you leave the system idle for more than 5 minutes or so. That’s probably when the limited periodic scans take place.  Limited Periodic Scanning doesn’t take care of real-time protection (as your primary antivirus program does that already) and it’s intended to offer an additional line of defense to your existing antivirus program’s real-time protection.

Turning on Limited Periodic Scanning activates the Windows Defender Service and its Early Launch Anti-Malware (ELAM) boot driver WdBoot.sys and Microsoft antimalware file system filter driver WdFilter.sys.

On the front end, it adds the Windows Defender Notification area icon, which is causing a little bit of confusion for users.



Related: Windows Security Icon Missing from Tray and the Task Manager Startup Tab

Why “Limited Periodic Scanning”?

Per MMPC, Microsoft’s Malicious Software Removal Tool (MSRT) scans over 500 million Windows devices for malware and malicious software every month. This tool aids in detecting and removing malware from 1 to 2 million machines each time, even on those devices running antivirus software.

So, in < 0.4% of the cases, the primary antivirus program failed to nab malware in the first place. And thankfully, MSRT got them. That’s the reason they introduced the Windows Defender Limited Periodic Scanning feature for secondary scanning — to make it more secure.

And don’t forget the Windows Defender Offline scanning feature built-in to Windows 10 and 11. Windows Defender Offline and Limited Periodic Scanning are two useful features you can use even if you have a 3rd-party antivirus solution in place.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

Leave a Comment