Configure Windows Defender Antivirus features

Applies to:

  • Windows 10


  • Enterprise security administrators

Windows Defender Antivirus can be configured with a number of tools, including:

  • Group Policy settings
  • System Center Configuration Manager
  • PowerShell cmdlets
  • Windows Management Instrumentation (WMI)
  • Microsoft Intune

The following broad categories of features can be configured:

  • Cloud-delivered protection
  • Always-on real-time protection, including behavioral, heuristic, and machine-learning-based protection
  • How end-users interact with the client on individual endpoints

The topics in this section describe how to perform key tasks when configuring Windows Defender AV. Each topic includes instructions for the applicable configuration tool (or tools).

You can also review the Reference topics for management and configuration tools topic for an overview of each tool and links to further help.

In this section

Topic Description
Utilize Microsoft cloud-provided protection in Windows Defender Antivirus Cloud-delivered protection provides an advanced level of fast, robust antivirus detection
Configure behavioral, heuristic, and real-time protection Enable behavior-based, heuristic, and real-time protection in Windows Defender AV
Configure end-user interaction with Windows Defender Antivirus Configure how end-users interact with Windows Defender AV, what notifications they see, and if they can override settings