Evaluate Windows Defender Antivirus protection

Applies to:

  • Windows 10, version 1703 and later


  • Enterprise security administrators

If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection.


You can also visit the Windows Defender Testground website at demo.wd.microsoft.com to confirm the following features are working and see how they work:

  • Cloud-delivered protection
  • Fast learning (including Block at first sight)
  • Potentially unwanted application blocking

It explains the important features available for both small and large enterprises in Windows Defender, and how they will increase malware detection and protection across your network.

You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings.

The guide is available in PDF format for offline viewing:

You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery:


The guide is currently intended for single-machine evaluation of Windows Defender Antivirus protection. Enabling all of the settings in this guide may not be suitable for real-world deployment.

For the latest recommendations for real-world deployment and monitoring of Windows Defender Antivirus across a network, see the Deploy, manage, and report topic in this library.