How to get the most out of Windows Defender: more security and better performance

If you use Windows 10 or Windows 11, you already have a very decent antivirus at home: Microsoft DefenderThe problem is that, as it comes out of the box, many users neither take full advantage of its protection level nor adjust its impact on performance. With a few well-thought-out changes, security can be significantly strengthened, and if you want, increase the level of protection without turning the PC into a tractor.

In the following lines you will see, in detail, how Strengthen the security of Windows Defender and at the same time fine-tune its performanceFrom the options visible in Windows Security, through advanced settings with PowerShell and Registry, to the new performance mode for developers in Windows 11. The idea is clear: to reduce real risks (malware, ransomware, identity theft…) without making the computer run slowly.

What exactly is Microsoft Defender today?

What we previously knew as Windows Defender is now integrated as Windows securityIt's a panel that centralizes antivirus, firewall, application control, kernel isolation, account protection, and family options. It's not just "the antivirus"; it's a complete security layer that also leverages Microsoft cloud services.

In this ecosystem, Microsoft Defender Antivirus is the piece that monitors files, processes, and downloads in real time, it is updated several times a day, including security intelligence updatesand relies on the cloud service (MAPS) for rapid decision-making in the face of emerging threats. On that foundation, we will build greater protection and improved performance.

Performance mode and Dev Drive in Windows 11

Windows 11 has a feature designed primarily for developers: Microsoft Defender Antivirus performance modeThis is linked to the new development drives (Dev Drives). It's not for everyone, but if you compile code or work with large repositories, you'll want to keep track of it.

Dev Drive is a special type of ReFS-based volume designed for development workloads with heavy disk accessIt allows you to optimize the file system, better manage volume security, define trust settings, and control filters such as antivirus software. Defender's performance mode comes into play on these development units.

When a Dev Drive is marked as “trusted”, Defender switches from a synchronous analysis to a asynchronous scanningTranslated: Instead of analyzing the file right before opening it (open now, scan now), it allows the opening operation to complete and defers the analysis (open now, analyze later). This reduces much the impact on the performance of builds, npm install, and other intensive tasks.

The price of this improvement is that, logically, there is slightly less immediate protection than with the classic synchronous mode. Even so, the level of defense remains far superior to using mass exclusions of folders, which directly prevent anything from being scanned in those paths.

Important: Performance mode only works in trust development units, not on the NTFS formatted system drive (C:, D:, etc.), and requires real-time protection to be enabled.

Prerequisites for using performance mode

To be able to pull in this way you need, at a minimum, to meet these points:

• Windows 11 as an operating system.
• Microsoft Defender Antivirus as main antiviruswithout it being eaten by a third party.
• Real-time and cloud-based protection enabled.
• Antimalware platform version equal to or higher than 4.18.2303.8.
• Anti-malware security intelligence equal to or greater than 1.385.1455.0.

And, of course, you'll need to have previously configured a Dev Drive. To do this, in Windows 11 you can create such a volume formatted as ReFS from the Settings interface or Disk Management, following the official guide. “Setting up a development unit”.

How to manage performance mode (Intune, GPO, PowerShell)

If you manage multiple teams, you can centrally monitor the status of Defender's performance mode:

With Intune You can use an OMA-URI configuration directive:

• OMA-URI route: ./Device/Vendor/MSFT/Defender/Configuration/PerformanceModeStatus
• Data type: integer.
• Values: 0 = enabled (default), 1 = disabled.

With Group policy There is a specific template:

1. Open the Group Policy Editor (gpedit.msc) and navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time protection.
2. Edit the directive Configure the performance mode status.
3. Select “Enabled”, apply and accept.

From PowerShellA single command executed as administrator is all that's needed:

Set-MpPreference -PerformanceModeStatus Enabled

To check which volumes are in performance mode, open the Windows Security app, go to Virus and threat protection > Manage development unit protection and click on “View Volumes”. There you will see something like this:

• System drive (C:, D: NTFS): Not suitable for performance mode.
• Dev Drive enabled but without active performance mode.
• Dev Drive enabled and Defender performance mode asset.

Leave Windows Defender properly configured from its interface

Beyond the developer world, every user should review their Windows Security settings. There are several key sections that should be fine-tuned if we want the system to be well-protected without creating a nightmare.

Enable app and browser control

The first thing is to make sure that the block of “Application and browser control” It's not half turned off. Sometimes it appears with a yellow icon asking you to turn it on.

1. Open Windows Security from the Start menu.
2. On the home screen, check the "Application and browser control" section.
3. If you see an activation button, click it and leave the icon green.

This module encompasses SmartScreen and the reputation-based protectionwhich is your first line of defense against strange downloads and unreliable executables.

Basic settings in Antivirus and threat protection

Within Windows Security, go to Antivirus and threat protection and scroll down to “Antivirus and threat protection settings” > “Manage settings”. Make sure these four options are enabled:

• Real-time protection.
• Cloud-based protection.
• Automatic sample shipment.
• Protection against tampering (prevents malware or other programs from changing the antivirus settings).

That sets the minimum reasonable security level. If any of these are disabled, Defender loses much of its effectiveness, as guides on [the topic] show. Windows Defender errorsespecially the cloud layer.

Ransomware protection and folder access control

There is a very powerful function that almost no one activates: the folder access controlWithin ransomware protection, it limits which programs can write to critical folders such as Documents, Pictures, or Videos.

To enable it:

1. In “Virus and threat protection”, scroll down to “Ransomware protection”.
2. Click on “Manage ransomware protection”.
3. Activate “Control folder access”.

From then on, any unrecognized application that attempts to modify files in those paths will be blocked, unless the authorize manuallyThis means that initially you may need to add some games or programs that save game progress and settings to Documents to the allowed list.

Reputation-based protection and SmartScreen

In the “Application and browser control” menu you will find the section for Reputation-Based ProtectionLeave it on full blast:

• “Check apps and files”: enabled.
• SmartScreen for Microsoft Edge: Enabled.
• Blocking potentially unwanted applications: all boxes checked (apps, sites, downloads).
• SmartScreen for Microsoft Store apps: Enabled.

This way, any suspicious installer downloaded from the Internet will go through a good filter before running, and Edge will block fraudulent or malware-laden websites more aggressively.

Exploit protection

Also included within “Application and Browser Control” is the protection against vulnerabilitiesHere you can apply mitigations globally or on a program basis. There is one particularly interesting option: “Force random image selection (mandatory ASLR)”.

For compatibility reasons, it's usually disabled by default. If you want to strengthen security and your software is relatively modern, you can set it to "Default" and Restart the systemThis forces libraries to be loaded into random memory addresses, making life more difficult for certain exploits.

Other advanced options: isolated browsing, kernel isolation

Some devices offer the option to isolated navigation For Edge (Application Guard), which launches the browser in a separate container from the system. If you only use Edge and have compatible hardware, it may be worth enabling (see how). activate sandbox).

In “Kernel Isolation” you will see “Memory Integrity”. This feature prevents malicious code from being injected into high-privilege processes, but on older systems it can cause noticeable performance dropsOn recent PCs with hardware virtualization enabled, it usually works better and is a good extra boost; on less powerful machines, you can leave it disabled to avoid problems.

Increase Defender's defense level using PowerShell

If you want to go a step further, you can significantly harden Microsoft Defender using Set-MpPreference from PowerShell. It's important to open PowerShell as administrator, or many commands will give you an error.

Increase the frequency and quality of signatures

The first thing is to make sure that the signature engine is always up to date:

Set-MpPreference -SignatureUpdateInterval 1 Set-MpPreference -CheckForSignaturesBeforeRunningScan $True

With this, Defender will check for updates every hour. and, in addition, it will check for new signatures just before starting a manual or scheduled analysis.

Activate and strengthen MAPS and cloud locking

The Microsoft Active Protection Service (MAPS) allows Defender to make decisions based on cloud data, which is especially useful for very new malware. You can put it in advanced mode:

Set-MpPreference -MAPSReporting 2

In this mode, the system shares more data with Microsoft about potentially malicious software (file names, behavior, etc.). In return, you gain effectiveness in zero-day detection.

For sending samples, you can refine your process as follows:

Set-MpPreference -SubmitSamplesConsent SendSafeSamples

This setting limits automatic sending to samples considered safe (without overly sensitive data). Other possible values ​​are AlwaysPrompt, NeverSend, or SendAllSamples.

To make the cloud more aggressive in blocking suspicious executables:

Set-MpPreference -CloudBlockLevel 4

The levels range from 0 (default) to 6 (zero tolerance). A value of 4 corresponds to one mode high+, quite strict without reaching the absolute maximum.

It's also a good idea to make sure that Defender blocks what it sees for the first time until it's analyzed:

Set-MpPreference -DisableBlockAtFirstSeen $False

And if your connection is slow or you have latency spikes, you can extend the maximum time the executable is held while being analyzed in the cloud:

Set-MpPreference -CloudExtendedTimeout 50

In this way, the cloud has up to 50 seconds to respond before permanently releasing or locking the file.

Strengthen protection against potentially unwanted applications

Potentially Unwanted Applications (PUAs/PUWs) are those "freebies" that come bundled with installers, toolbars, and other annoying software. To keep them at bay:

Set-MpPreference -PUAPotection Enabled (Get-MpPreference).PUAPotection

The second command returns the status. If you see a 1, is activated; 0 means deactivated.

Validate the connection with MAPS

To ensure your PC connects successfully to the cloud service, you can run:

"C:\Program Files\Windows Defender\mpCmdRun.exe" -validatemapsconnection

If it returns “successfully established"Communication is in order and everything you have configured at the cloud and MAPS level has a real effect."

Advanced Registry settings for maximum aggressiveness

If you're not afraid to tinker with the Registry, there are several keys that allow you to fine-tune Defender's behavior even further. But first, Make a backup of the registry or create a restore point in case you need to go back.

Open the registry editor (Win + R > regedit) and navigate to:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows Defender

There you will create two new subkeys: MpEngine y spy net.

Keys in MpEngine

In the MpEngine key, add:

• DWORD value (32 bits) MpBafsExtendedTimeout with a value of 0x19 (25 in decimal) or the one you define according to your needs, to extend the maximum time of blocking suspicious files while they are being analyzed.
• DWORD value (32 bits) MpCloudBlockLevel with a value of 2 (hexadecimal) to increase cloud blocking aggressiveness above standard values.

This allows you to defend retain suspicious files for longer and be tougher when deciding to block them if their behavior or reputation is unconvincing.

Keys in Spynet

In the Spynet key, create these 32-bit DWORD values:

• DisableBlockAtFirstSeen with a value of 0 (keeps the lock active in the first view).
• SpynetReporting with a value of 2 (advanced participation mode, similar to MAPSReporting 2).
• LocalSettingOverrideSpynetReporting with a value of 1 (allows local settings to take precedence over group policies).
• SubmitSamplesConsent with a value of 1 when you want the samples to be sent automatically according to the configured telemetry level.

After applying these changes, restart your computer. From that moment on, Defender will have even more aggressive behavior in the face of recent threats, but it will also send more data to Microsoft, something you should consider from a privacy standpoint.

Choosing wisely what to analyze and what not to: intelligent exclusions

Defender allows you to exclude files, folders, extensions, or entire processes from its scans. It's a very useful tool for reducing conflicts and improving performance, but if misused, it can become a massive liability.

To configure exclusions, see how exclude apps:

1. Open Windows Security > “Virus and threat protection”.
2. Click on “Manage settings”, within “Antivirus and threat protection settings”.
3. Scroll down to “Exclusions” and tap “Add or remove exclusions”.
4. Choose what you will exclude: file, folder, file type, or process.

The sensible thing to do is to use exclusions in a very surgical way, for example, to:

• Temporary paths for development tools that are already protected by Dev Drive's performance mode.
• Some corporate executable that you know 100% is safe and it always flags it as a false positive.

Avoid excluding folders like Downloads, Desktop, or Documents, because that's exactly where they tend to end up. the real threats.

Best practices for performance when Defender “weighs down” the system

If you notice that the antivirus is consuming the machine (fans running at full speed, freezing, etc.), it is advisable to first rule out underlying problems that are not directly the fault of Defender.

Try other antivirus programs and perform a clean boot.

The first thing to check is that you don't have another antivirus program running in parallel. Having Defender plus a third-party antivirus often causes problems. scan crashes and double consumption of resources. Uninstall or disable any additional solutions and leave only Defender.

Then you can try a clean start to see if there are any third-party services interfering:

1. Run msconfig and on the “Services” tab check “Hide all Microsoft services” and disable the rest.
2. On the "Windows Startup" tab, open the Task Manager and disable everything that is not essential.
3. Restart and check if performance improves while Defender is active.

If the PC runs smoothly in this scenario, the problem is usually in some specific software or conflicting drivernot in Defender as such.

Repair system files and clean your computer

If there are corrupted files, Defender can spend all day fighting them and degrade performance. Use system repair tools:

sfc /scannow dism /online /cleanup-image /restorehealth

First, run SFC, and if it finds errors, then run DISM. Next, ensure that Windows and Defender definitions are up to date. fully updated from Windows Update.

It's a good idea to run an official Microsoft troubleshooter for general performance and check disk usage with Resource Monitor to see if any process is consistently pushing the percentage to 100%.

Additional layers of security and privacy in Windows

Beyond the antivirus, the operating system itself offers several components that, combined, greatly raise the bar of security without the need to install anything extra.

Password, PIN or biometrics and credential expiration

It's surprising how many computers start directly without password or PINTo protect local access:

1. Go to Settings > Accounts > Sign-in options.
2. Set up Windows Hello (PIN, fingerprint, facial recognition) or, at the very least, a strong password.

In environments where it's important for the key to change periodically, you can force its expiration:

1. Open Run > netplwiz and go to the “Advanced Options” tab.
2. Go to “Advanced Options” under “Advanced User Administration” and open Local Users and Groups.
3. For the corresponding user, uncheck “The password never expires”.

You can also do it from the console, by enabling global expiration:

wmic UserAccount set PasswordExpires=True

And for a specific user:

wmic UserAccount where Name="UserName" set PasswordExpires=True

User Account Control (UAC) and Account Type

User Account Control (UAC) is that prompt that appears asking for permission when a program wants to make significant changes. It's tempting to lower or disable it, but it's a critical barrier against malware that attempts to infiltrate with elevated privileges.

Check its status from Control Panel > System and Security > Security and Maintenance > Security. Make sure User Account Control is enabled and at a reasonably strict level.

Also, consider using a standard local account For everyday use, maintain an administrator account only for specific tasks. This greatly reduces the impact of any attack that sneaks in through the browser or a malicious attachment.

Local account vs. Microsoft account

A Microsoft account lets you sync settings and use cloud services, but it also increases your online attack surface. If you prefer to maximize privacy and reduce reliance on external services, you can use a local account.

If you already have a linked Microsoft account:

1. Go to Settings > Accounts > Your information.
2. Click on “Log in with a local account instead”.
3. Follow the wizard and then log out.

However, if you want to take full advantage of features like OneDrive synchronization or Defender's identity theft monitoring, a Microsoft account is practically mandatory.

Parental Controls and Family Monitoring

If minors are using the equipment, the module of Family options In Windows Security, it's an important ally. It works linked to child Microsoft accounts and allows:

• Review online activity and screen time.
• Restrict which websites they can visit or block dangerous categories.
• Limit which games and applications can run.
• Set schedules and maximum daily usage time.

All of this is managed from the Microsoft family website or from the My Defender app itself, if you have it installed.

Identity theft monitoring with Mi Defender

One of Defender's newest features is the identity verification, integrated with Experian technology and aimed at monitoring whether your personal data ends up circulating on the dark web.

To set it up:

1. Open My Defender (the modern version of the security app).
2. Go to the identity theft section and click on “Introduction”.
3. Create your profile indicating the data you want to protect (email, phone, etc.).
4. If you want, add family members so they are covered too.

From there, the system will scan known sources of leaks and It will notify you if it locates your data in lists of stolen credentials, so you can change passwords and take action in time.

Firewall, providers and notifications: polishing the final details

The firewall section is usually well configured by default, but it's advisable to ensure that it is active in all profiles (domain, private and public) from "Firewall and network protection" in Windows Security.

In the "Manage providers" link, you can see which module is responsible for antivirus, firewall, and web protection. It should normally appear Microsoft Defender In antivirus and firewall; if another program is taking control, you'll have to decide which one you really want to be in charge.

Finally, the Windows Security notifications section lets you fine-tune which alerts to see and which to ignore. It's helpful to reduce the noise by disabling purely informational notifications (for example, "last scan successful, zero threats"), while keeping others active. only critical warnings and those related to actual crashes or configuration problems; if you need to, learn how disable notifications.

With this whole set of adjustments—from performance mode in Dev Drive and reinforcement via PowerShell and Registry, to ransomware, reputation, UAC, firewall, and identity monitoring options—Microsoft Defender goes from being “the default antivirus” to a A very serious and quite lightweight security suiteTaking the time to customize it to your liking makes all the difference between a Windows system that merely "defends itself" and one that truly protects you without making you feel like you're dragging an anchor every time you turn on your PC.