Windows Defender on Windows Server: Protection, Exclusions, and Scans

Windows Defender Antivirus is built into Windows Server 2016 and later, but on a fresh VPS it is often disabled, running stale signatures, or fighting your IIS and SQL Server workloads. This guide shows you how to verify its status, keep definitions current, add the right exclusions, and run scans from PowerShell. You will need an account with local administrator rights on the server; everything here runs from an elevated PowerShell session, with no third-party tools required.

Check Whether Defender Is Actually Running

Start by querying the service state and protection status:

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureVersion, AntivirusSignatureAge

If AntivirusEnabled is False, a third-party antivirus product is installed and Defender has stepped aside. If you removed that product, re-enable real-time protection with:

Set-MpPreference -DisableRealtimeMonitoring $false
Start-Service WinDefend

Note that an AntivirusSignatureAge over 7 days means the server is missing recent protection. On Windows Server, Defender can also be in “passive mode” when another AV is present; in that case it reports detections but takes no action, which is fine as long as the primary AV is managed.

Keep Signatures Updated

On Windows Server, definition updates are not guaranteed by the default Windows Update settings. Force an update and set a sane fallback order:

Update-MpSignature
Set-MpPreference -SignatureFallbackOrder "MicrosoftUpdateServer|MMPC|WU"

On a VPS with no direct internet route to Microsoft’s update servers (some providers NAT traffic), test the update manually and adjust the fallback order so signatures still arrive. To keep definitions fresh without relying on memory, create a weekly scheduled task that runs Update-MpSignature:

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -Command Update-MpSignature"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 3am
Register-ScheduledTask -TaskName "Defender Signature Update" -Action $action -Trigger $trigger

Add Exclusions for IIS, SQL Server, and Build Agents

Real-time scanning of high-I/O paths is the most common cause of CPU spikes and slow page loads on a Windows VPS. Typical culprits are IIS logs, SQL Server data files, and CI/CD working directories. Exclude them explicitly:

Add-MpPreference -ExclusionPath "C:\inetpub\logs", "D:\Data", "C:\agent\_work"
Add-MpPreference -ExclusionProcess "w3wp.exe", "sqlservr.exe", "msbuild.exe", "dotnet.exe"

Workload	Recommended exclusions
IIS / ASP.NET Core	C:\inetpub\logs, w3wp.exe, dotnet.exe
SQL Server	.mdf/.ldf data directories, sqlservr.exe
CI/CD build agents	agent _work folder, msbuild.exe, node.exe
Backup tools	wbadmin staging directory

Keep exclusions as narrow as possible. Never exclude an entire drive letter that contains user uploads or web root content you do not fully control. After any change, review the full exclusion list with Get-MpPreference | Select-Object -ExpandProperty ExclusionPath so you can audit it later.

Run a Scan and Review Detections

After configuring exclusions, run a quick scan, then review what was found:

Start-MpScan -ScanType QuickScan
Get-MpThreatDetection | Select-Object ThreatID, ProcessName, Resources | Format-List

For a first-time full scan on a busy production server, schedule it during off-peak hours. A full scan of several hundred gigabytes can take hours and will compete with IIS and SQL Server for disk I/O. You can set the weekly scan schedule directly:

Set-MpPreference -ScanScheduleDay 1 -ScanScheduleQuickScanTime "02:00"
Set-MpPreference -ScanAvgCPULoadFactor 30

The CPU load factor caps how much processor a scan may consume, which keeps a scan from tanking latency on a busy web server.

Defender also exposes two settings worth checking on a server that handles customer data. Cloud-delivered protection (MAPS) submits samples to Microsoft for faster detection, and tamper protection stops malware from disabling the antivirus itself. On a VPS you manage over RDP, both are usually safe to enable:

Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -EnableControlledFolderAccess Disabled   # only if your apps write to protected folders

• Check Get-MpComputerStatus weekly – watch SignatureAge and RealTimeProtectionEnabled.
• Re-run Get-MpThreatDetection after any incident report from your applications.
• Audit the exclusion list after every major software install; stale exclusions are a security hole.

Defender is a solid baseline for a single Windows VPS. When you scale to several servers, look at central management options such as Microsoft Defender for Cloud or Windows Admin Center. You can also compare Windows VPS providers on our comparison table to find a plan with enough CPU headroom for antivirus overhead, or browse the provider reviews on windows-vps.org first.

If you are setting up a new Windows VPS to test this configuration, Hostwinds offers Windows VPS plans with fully managed options that save you the initial hardening work.