Microsoft Defender Antivirus is built into Windows Server 2016 and later, and is enabled by default. For most Windows VPS workloads, it’s all the antivirus you need, provided it’s updated, configured with sensible exclusions, and not fighting another security product. Here’s how to manage it, mostly with PowerShell.

Check status

Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated, QuickScanAge
Get-MpPreference | Select-Object DisableRealtimeMonitoring, ExclusionPath, ExclusionProcess

On Desktop Experience, Windows Security shows the same information in the GUI. On Server Core, use PowerShell. See Server Core vs Desktop Experience.

Keep signatures updated

Signatures update through Windows Update. Force an update with:

Update-MpSignature

Make sure the server can reach Windows Update and Microsoft’s definition servers (outbound HTTPS). See Windows Update with PowerShell.

Run scans

Start-MpScan -ScanType QuickScan
Start-MpScan -ScanType FullScan          # heavy; schedule off-peak
Start-MpScan -ScanType CustomScan -ScanPath "C:\Uploads"
Get-MpThreatDetection                    # what was found
Get-MpThreat

Schedule scans for quiet hours:

Set-MpPreference -ScanScheduleDay Everyday -ScanScheduleTime 03:00:00 -ScanParameters 1   # 1 = quick

Exclusions (performance without blind spots)

Real-time scanning of constantly changing data files (databases, logs, caches) wastes CPU and I/O, and can even cause corruption or locking issues. Microsoft publishes recommended exclusions for its server products. Add specific folders, file types or processes, not whole drives:

# SQL Server data and log files
Add-MpPreference -ExclusionPath "D:\SQLData", "D:\SQLLogs"
Add-MpPreference -ExclusionExtension ".mdf", ".ldf", ".ndf"

# IIS logs and temporary compressed files
Add-MpPreference -ExclusionPath "C:\inetpub\logs", "C:\inetpub\temp\IIS Temporary Compressed Files"

# a trusted application's data folder
Add-MpPreference -ExclusionPath "C:\TradingApp\Data"

Don’t exclude folders where users upload files (web upload directories), downloads, or temp folders. Those are exactly where malware arrives.

Windows Server automatically excludes files for installed server roles (for example DNS or Hyper-V files). You don’t need to add those by hand.

Don’t disable it, and don’t run two antivirus products

  • Turning off real-time protection “for performance” removes your main defence. Use exclusions instead.
  • If you install a third-party antivirus, Defender should switch to passive mode automatically on Windows Server. Running two active real-time scanners causes slowdowns and conflicts.
  • Tamper protection prevents malware (or scripts) from disabling Defender. Keep it on where available.

Useful extras

Set-MpPreference -PUAProtection Enabled                # block potentially unwanted apps
Set-MpPreference -EnableNetworkProtection Enabled      # block known-bad domains (where supported)
Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples   # cloud protection

Attack Surface Reduction (ASR) rules can block common malware behaviours (Office macros starting processes, credential theft from LSASS). Test them in audit mode first.

Responding to a detection

When Defender reports a threat:

  1. Check what it found and where: Get-MpThreatDetection shows the file path, the threat name, and the action taken (quarantined or removed).
  2. Ask how it got there. Was it uploaded through a website, downloaded by a user over RDP, or dropped by a compromised application?
  3. Look for related activity in the event logs around the same time: new users, unusual logons, scheduled tasks, services. See Windows Event Viewer errors.
  4. Change passwords that may have been exposed, and close the entry point.
  5. If you can’t rule out a deeper compromise, rebuild the server, and restore clean data from backups.

Defender is one layer

Antivirus doesn’t replace:

Quick reference

Task Cmdlet
Status Get-MpComputerStatus
Update Update-MpSignature
Quick scan Start-MpScan -ScanType QuickScan
Threats found Get-MpThreatDetection
Add exclusion Add-MpPreference -ExclusionPath "…"
Scheduled scan Set-MpPreference -ScanScheduleTime 03:00:00

Related: Windows Server performance tuning and Windows Event Viewer errors.

  • Windows Server
  • Security
  • Antivirus