Windows Security: scans, exclusions and ransomware protection
Windows Security is the free protection built into Windows 10 and 11. Most of the time it looks after itself. Here is how to run a scan, what exclusions are and why you should avoid them, and how to turn on extra protection for your files.
Open it
Press the Windows key, type Windows Security and open it. A green tick on each item means all is well. If you installed another antivirus, Windows Security may show that the other one is in charge.
Run a scan
- Click Virus & threat protection.
- Click Quick scan for a fast check.
- For a thorough check, click Scan options, choose Full scan, and click Scan now. It can take an hour or more, so leave the PC plugged in.
- If you suspect something nasty is hiding, choose Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and scans before Windows loads.
Exclusions: please be careful
An exclusion tells Windows Security to ignore a file, folder or program. It is under Virus & threat protection, Manage settings, Exclusions, Add or remove exclusions.
Only add an exclusion if the software's maker tells you to, and you are certain the software is genuine. Never add one because a website, a pop-up or a caller tells you to. That is a common trick to let malware in.
Ransomware protection
Ransomware locks your files and demands money.
- In Virus & threat protection, scroll to Ransomware protection and click Manage ransomware protection.
- Switch Controlled folder access on.
It stops unknown programs from changing files in folders such as Documents and Pictures. Sometimes it will block a program you trust. If that happens, use Allow an app through Controlled folder access and add that program. If you have OneDrive, there is also an option to recover files after an attack.
Do not switch off real-time protection.
When to get more help
Get in touch if a threat is found and cannot be removed, if Windows Security will not open or is switched off and cannot be turned on, or if files have become unreadable or renamed. In that case switch off the PC from the network and contact us at once.