How to Improve Windows Defender: Tricks to Optimize Windows Security

To many users, Windows Defender is basically a meme. To others, it's the first thing to disable on any Windows 10 or Windows 11 installation. However, all this tool needs to offer a more robust defense is a little help. That's right: the end user can do a lot to improve Windows Defender by checking secondary options in its interface and enabling advanced parameters through PowerShell.

Maybe This Isn't for You, But...

I understand. You're an advanced user and want absolute control over your computer's security. Maybe your main strategy is to replace Windows Defender with something else, or even replace Windows directly with your favorite Linux flavor. But sometimes, perfect is the enemy of good, and for the vast majority of users, Windows Defender is more than enough.

Think of it this way: those users don't even want to interact with Windows Defender... or any other security solution. They don't want pop-ups, alerts, or exclusive offers for premium antivirus. Also, Windows Defender has improved a lot over the years (though its performance on some computers remains a pending issue), and independent tests such as AV-Test and AV-Comparatives reflect that.

So the idea of this article is to improve Windows Defender for someone else. With some adjustments to its interface and a handful of advanced commands via PowerShell, Microsoft's security system will be a more than appropriate option to protect general Windows and Windows 11 installations. Let's begin.

How to Improve Windows Defender on Windows 10 and 11

• The first step is to go to the Windows Security Home section and verify that "App and browser control" is enabled. We've noticed that on some installations this must be activated manually, despite Windows' own warnings. Click "Activate", and the icon will turn from yellow to green.

• Then we go to "Virus and threat protection". In the "Antivirus and threat protection settings" section we click "Manage settings", and there we confirm that its four main functions are enabled: Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper protection.

• Don't leave that section: Below appears "Controlled folder access", better known as "Ransomware protection". If you enable the option, Windows will limit access to the user's folders (Documents, Videos, Pictures, etc.), unless the application is authorized manually. This can cause conflicts with some programs and games (many of them save game saves in Documents), so you'll need to evaluate its impact more closely.

Reputation and Isolation

• Inside the "App and browser control" menu you'll find two options: Reputation-based protection, and Exploit protection. In the first one you must check that everything is enabled (Check apps and files, SmartScreen for Microsoft Edge, Potentially unwanted app blocking with all checkboxes marked, and SmartScreen for Microsoft Store apps).
• In the second, you'll notice that the option "Force randomization for images (Mandatory ASLR)" comes disabled by default due to possible incompatibilities with some executables. However, the idea is to strengthen security, so we change it to "By default" and restart the computer.

• Some users may also find the "Isolated browsing" option. This runs Microsoft Edge in an isolated environment, placing an additional barrier between any malicious element and the rest of the system. If Edge is the only browser on the computer, you should consider this option. (Author's note: Not all computers support this).

• Finally, we come to the so-called "Core isolation". Inside it is the "Memory integrity" option, which blocks the insertion of malicious code into high-level processes. The good news is that Windows improves its security profile if we enable this, but the bad news is that it drags a significant performance loss, especially on computers with some years on their shoulders. Personally, I keep Memory integrity disabled, but if you're preparing a next-generation computer, you should give it a try.

Improving Windows Defender via PowerShell

Nothing stops you from limiting Windows Defender adjustments to its graphical interface, but there are several PowerShell commands that are definitely worth exploring. Open PowerShell with elevated administrator privileges, otherwise you'll get all sorts of errors.

• Set-MpPreference -SignatureUpdateInterval 1 sets the frequency to check for new definitions to one hour. Valid values for this parameter range from 1 to 24 hours.
• Set-MpPreference -CheckForSignaturesBeforeRunningScan $True tells Windows Defender to check for new definitions before starting its scan. Allowed values are boolean, $False and $True.

• Set-MpPreference -MAPSReporting 2 makes the computer activate the Microsoft Active Protection Service in advanced mode, sharing additional information with Microsoft about potentially malicious software. If you don't want this, change the value to 0, but the modifications we mention below won't work.
• Set-MpPreference -SubmitSamplesConsent SendSafeSamples allows us to limit the consent level for sending safe samples. Accepted values are AlwaysPrompt, SendSafeSamples, NeverSend, and SendAllSamples.
• Set-MpPreference -CloudBlockLevel 4 allows us to raise Defender's aggressiveness when scanning executables. The supported levels are four: 0 (default), 2 (high), 4 (high+), and 6 (zero tolerance). Our example sets the command to high+.
• Set-MpPreference -DisableBlockAtFirstSeen $False confirms that Windows Defender will block an item if it's the first time it encounters it.
• Set-MpPreference -CloudExtendedTimeout 50 extends the time Windows Defender can block an executable for cloud analysis to 50 seconds. The default value is 10 seconds, but some connections need the extra time.
• Set-MpPreference -PUAProtection Enabled can be modified in the Windows Defender graphical interface, but it essentially enables protection against potentially unwanted applications. The command $(Get-MpPreference).PUAProtection checks its status (1 means enabled).

• As a closing, we go to the root of drive C and with the command .\"Program Files\Windows Defender\mpCmdRun.exe" -validatemapsconnection we validate the connection to MAPS. If it reports "successfully established", everything is in order.

In Summary

The article may seem long, but in practice, improving Windows Defender only takes a few minutes. If this topic interests you and you want to study other advanced values more closely, the official Microsoft documentation has many details, including the -EnableLowCpuPriority command, ideal for humbler processors. Good luck!