# Windows Defender

Windows Service: Microsoft Corporation

Also called windefend, windows defender service, microsoft defender antivirus service

Windows, Microsoft

The Windows service that keeps Microsoft Defender Antivirus running.

## What you need to know

This is the Defender service contract.

WinDefend keeps the Defender engine running. MsMpEng.exe does the scan. Disabling this service without another antivirus is a security gap.

- **Important?**: Yes, if Defender is your antivirus

  **Safe to disable?**: No, unless another AV is active

  **Related process?**: MsMpEng.exe

Feex says

If someone tells you to disable WinDefend to speed up a game, I would ask what is scanning instead. A PC with no antivirus is not a tune-up.

## What does this service do?

Display name: Microsoft Defender Antivirus Service. Service name: WinDefend.

WinDefend is the service that hosts and controls Microsoft Defender Antivirus. The engine process is MsMpEng.exe.

## History on Windows

Still present

Microsoft Defender Antivirus grew out of Windows Defender and Microsoft Security Essentials. On current Windows 10 and Windows 11, WinDefend is the in-box antivirus service unless another product registered as the active provider.

| In-box antivirus on | Windows 8 and later, with earlier Defender forms before that |
| ------------------- | ------------------------------------------------------------ |
| Still present       | Yes, including Windows 11                                    |
| Discontinued        | No                                                           |

## Why does Windows need it?

Windows needs a service that can start the engine, apply policy, and stay running after a scan.

## When does it run?

It should be available whenever Defender is the active antivirus. The engine may idle between scans.

## Should it always be running?

If Defender is active, this service should be able to run. If another antivirus is active, Windows may put Defender in a passive state.

## Can I disable it?

No, unless another antivirus is active

Do not disable WinDefend to save CPU if Defender is your only antivirus. If a third-party suite is active, Windows Security should show that. Follow that product, not a random registry tip.

## What happens if I disable it?

Live protection stops unless another registered antivirus takes over. That is a security change, not a cosmetic one.

## Process host

The service is WinDefend. The engine you see in Task Manager is usually Antimalware Service Executable. See MsMpEng.exe.

## Dependencies

| Depends on | RPC and other security components |
| ---------- | --------------------------------- |
| Used by    | Windows Security                  |

## Resource behavior

- **CPU**: Follows the engine during a scan

  **Disk**: Can rise during a full scan

  **Memory**: Definitions stay resident

  **Network**: Signature updates

## Common problems

### Service will not start

Another antivirus may own the slot, or a policy disabled Defender. Check Windows Security before you force the service.

### High CPU blamed on the service

Look at MsMpEng.exe and whether a scan is running.

## Troubleshooting

Safe steps first.

### Open Windows Security

See which antivirus is active. That page is more honest than a forum post.

### Do not delete the engine

Repair with Windows Security or a Microsoft troubleshooter. Do not delete MsMpEng.exe.

## Technical details

Technical details

| Display name | Microsoft Defender Antivirus Service |
| ------------ | ------------------------------------ |
| Service name | WinDefend                            |
| Engine       | MsMpEng.exe                          |

## Related

These entities connect to this article. Type is shown on every link.

[MsMpEng.exe: Windows Process](https://feex.it/wiki/process/msmpeng.exe)[Windows Security: Application](https://feex.it/wiki/software/windows-security)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Official Defender documentation

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Display name**: Microsoft Defender Antivirus Service

  **Service name**: WinDefend

  **Related process**: [MsMpEng.exe](https://feex.it/wiki/process/msmpeng.exe)

  **Safe to disable?**: No, unless another antivirus is the active provider

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/service/windows-defender/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)