Microsoft Defender is the antivirus engine that Windows manages through the Windows Security interface. It watches files and processes as the computer opens or downloads them, runs manual scans, and records actions against detected malware or potentially unwanted applications. It acts on local files, running processes, and selected folders; it does not repair every damaged setting or replace a separate copy of important data. A clean scan means the selected scan found no known threat at that time.
Scans cover different ground
A quick scan checks the system areas where threats commonly start. A full scan reads every file and running program that Microsoft Defender can reach, so it takes much longer on a large or slow disk. A custom scan limits the job to a chosen file or folder. Choosing a narrow folder can answer one question quickly, but it says nothing about an infection elsewhere.
Microsoft Defender Offline handles a different problem. It restarts the computer and scans from Windows Recovery Environment, before the ordinary Windows session loads. Persistent malware then has less opportunity to hide behind a running process. The restart closes open work, and Windows restarts again after the scan, so unsaved documents must be saved first. Protection history displays the result after the user signs back in.
History has a deadline
Protection history collects detections, removed potentially unwanted applications, and warnings about security services that have been turned off. Each card can expose the affected item and the action Microsoft Defender took. Some cards wait for a decision, while others document an action that already happened.
The list keeps events for only two weeks. Waiting longer can remove the convenient card even though another system log or quarantine record may still exist. Restoring an item tells Microsoft Defender to return it to its earlier location, while allowing a detected item tells the scanner to stop treating that item as a threat. Either choice needs a known reason, especially when the file arrived from an unverified download.
Exclusions change protection
Microsoft Defender accepts exclusions for one file, an entire folder, a file extension, or a process. These controls can reduce repeated scanning around a trusted build directory or another workload, but their scope differs. A folder exclusion covers every file below that folder. A file-type exclusion covers matching files wherever they appear. A process exclusion applies to files that the named process opens during real-time scanning; scheduled or manual scans may still inspect them unless another exclusion covers the file or folder.
An exclusion creates a hiding place if malware reaches the same path or extension. Microsoft advises using the full path and filename for a process because excluding a common executable name makes impersonation easier. Microsoft Defender should retain the narrowest workable exception, and the user should remove it when the conflicting task ends.
Folders can reject apps
Controlled folder access restricts changes to protected locations. Known applications continue writing there, while an unknown or untrusted program can receive a block even when the program itself is legitimate. The user can allow a trusted program through the protection list, but that permission should identify the exact executable rather than disabling the control for every folder.
Adding another protected folder changes which applications may write to it; it does not copy the folder anywhere. Ransomware protection can prevent an unwanted change, but Microsoft Defender cannot recover a file that has no unaffected copy after hardware loss, deletion, or an allowed program’s mistake. Backup and antivirus therefore answer different failure cases.
