Windows Defender
Also called windefend, windows defender service, microsoft defender antivirus service
The Windows service that keeps Microsoft Defender Antivirus running.
What you need to know
This is the Defender service contract.
WinDefend keeps the Defender engine running. MsMpEng.exe does the scan. Disabling this service without another antivirus is a security gap.
- Important?
- Yes, if Defender is your antivirus
- Safe to disable?
- No, unless another AV is active
- Related process?
- MsMpEng.exe
What does this service do?
Display name: Microsoft Defender Antivirus Service. Service name: WinDefend.
WinDefend is the service that hosts and controls Microsoft Defender Antivirus. The engine process is MsMpEng.exe.
History on Windows
Still present
Microsoft Defender Antivirus grew out of Windows Defender and Microsoft Security Essentials. On current Windows 10 and Windows 11, WinDefend is the in-box antivirus service unless another product registered as the active provider.
| In-box antivirus on | Windows 8 and later, with earlier Defender forms before that |
|---|---|
| Still present | Yes, including Windows 11 |
| Discontinued | No |
Why does Windows need it?
Windows needs a service that can start the engine, apply policy, and stay running after a scan.
When does it run?
It should be available whenever Defender is the active antivirus. The engine may idle between scans.
Should it always be running?
If Defender is active, this service should be able to run. If another antivirus is active, Windows may put Defender in a passive state.
Can I disable it?
No, unless another antivirus is active
Do not disable WinDefend to save CPU if Defender is your only antivirus. If a third-party suite is active, Windows Security should show that. Follow that product, not a random registry tip.
What happens if I disable it?
Live protection stops unless another registered antivirus takes over. That is a security change, not a cosmetic one.
Process host
The service is WinDefend. The engine you see in Task Manager is usually Antimalware Service Executable. See MsMpEng.exe.
Dependencies
| Depends on | RPC and other security components |
|---|---|
| Used by | Windows Security |
Resource behavior
- CPU
- Follows the engine during a scan
- Disk
- Can rise during a full scan
- Memory
- Definitions stay resident
- Network
- Signature updates
Common problems
Service will not start
Another antivirus may own the slot, or a policy disabled Defender. Check Windows Security before you force the service.
High CPU blamed on the service
Look at MsMpEng.exe and whether a scan is running.
Troubleshooting
Safe steps first.
Open Windows Security
See which antivirus is active. That page is more honest than a forum post.
Do not delete the engine
Repair with Windows Security or a Microsoft troubleshooter. Do not delete MsMpEng.exe.
Technical details
Technical details
| Display name | Microsoft Defender Antivirus Service |
|---|---|
| Service name | WinDefend |
| Engine | MsMpEng.exe |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft Learn: Defender Antivirus · Official Defender documentation
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.