{"id":260,"date":"2026-01-06T02:00:17","date_gmt":"2026-01-06T02:00:17","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=260"},"modified":"2026-08-09T22:27:37","modified_gmt":"2026-08-09T22:27:37","slug":"how-to-connect-to-a-vps-windows-7-a-step-by-step-guide-for-beginners-and-professionals","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/how-to-connect-to-a-vps-windows-7-a-step-by-step-guide-for-beginners-and-professionals\/","title":{"rendered":"Windows Defender on Windows Server: Protection, Exclusions, and Scans"},"content":{"rendered":"\n

Windows Defender Antivirus is built into Windows Server 2016 and later, but on a fresh VPS it is often disabled, running stale signatures, or fighting your IIS and SQL Server workloads. This guide shows you how to verify its status, keep definitions current, add the right exclusions, and run scans from PowerShell. You will need an account with local administrator rights on the server; everything here runs from an elevated PowerShell session, with no third-party tools required.<\/p>\n\n\n\n

Check Whether Defender Is Actually Running<\/h2>\n\n\n\n

Start by querying the service state and protection status:<\/p>\n\n\n\n

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureVersion, AntivirusSignatureAge<\/code><\/pre>\n\n\n\n
If AntivirusEnabled<\/code> is False, a third-party antivirus product is installed and Defender has stepped aside. If you removed that product, re-enable real-time protection with:<\/p>\n\n\n\n
Set-MpPreference -DisableRealtimeMonitoring $false\nStart-Service WinDefend<\/code><\/pre>\n\n\n\n
Note that an AntivirusSignatureAge<\/code> over 7 days means the server is missing recent protection. On Windows Server, Defender can also be in “passive mode” when another AV is present; in that case it reports detections but takes no action, which is fine as long as the primary AV is managed.<\/p>\n\n\n\n
Keep Signatures Updated<\/h2>\n\n\n\n
On Windows Server, definition updates are not guaranteed by the default Windows Update settings. Force an update and set a sane fallback order:<\/p>\n\n\n\n
Update-MpSignature\nSet-MpPreference -SignatureFallbackOrder \"MicrosoftUpdateServer|MMPC|WU\"<\/code><\/pre>\n\n\n\n
On a VPS with no direct internet route to Microsoft’s update servers (some providers NAT traffic), test the update manually and adjust the fallback order so signatures still arrive. To keep definitions fresh without relying on memory, create a weekly scheduled task that runs Update-MpSignature<\/code>:<\/p>\n\n\n\n
$action = New-ScheduledTaskAction -Execute \"powershell.exe\" -Argument \"-NoProfile -Command Update-MpSignature\"\n$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 3am\nRegister-ScheduledTask -TaskName \"Defender Signature Update\" -Action $action -Trigger $trigger<\/code><\/pre>\n\n\n\n
Add Exclusions for IIS, SQL Server, and Build Agents<\/h2>\n\n\n\n
Real-time scanning of high-I\/O paths is the most common cause of CPU spikes and slow page loads on a Windows VPS. Typical culprits are IIS logs, SQL Server data files, and CI\/CD working directories. Exclude them explicitly:<\/p>\n\n\n\n
Add-MpPreference -ExclusionPath \"C:\\inetpub\\logs\", \"D:\\Data\", \"C:\\agent\\_work\"\nAdd-MpPreference -ExclusionProcess \"w3wp.exe\", \"sqlservr.exe\", \"msbuild.exe\", \"dotnet.exe\"<\/code><\/pre>\n\n\n\n
Workload<\/th>Recommended exclusions<\/th><\/tr><\/thead>
IIS \/ ASP.NET Core<\/td>C:\\inetpub\\logs, w3wp.exe, dotnet.exe<\/td><\/tr>
SQL Server<\/td>.mdf\/.ldf data directories, sqlservr.exe<\/td><\/tr>
CI\/CD build agents<\/td>agent _work folder, msbuild.exe, node.exe<\/td><\/tr>
Backup tools<\/td>wbadmin staging directory<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Keep exclusions as narrow as possible. Never exclude an entire drive letter that contains user uploads or web root content you do not fully control. After any change, review the full exclusion list with Get-MpPreference | Select-Object -ExpandProperty ExclusionPath<\/code> so you can audit it later.<\/p>\n\n\n\n
Run a Scan and Review Detections<\/h2>\n\n\n\n
After configuring exclusions, run a quick scan, then review what was found:<\/p>\n\n\n\n
Start-MpScan -ScanType QuickScan\nGet-MpThreatDetection | Select-Object ThreatID, ProcessName, Resources | Format-List<\/code><\/pre>\n\n\n\n
For a first-time full scan on a busy production server, schedule it during off-peak hours. A full scan of several hundred gigabytes can take hours and will compete with IIS and SQL Server for disk I\/O. You can set the weekly scan schedule directly:<\/p>\n\n\n\n
Set-MpPreference -ScanScheduleDay 1 -ScanScheduleQuickScanTime \"02:00\"\nSet-MpPreference -ScanAvgCPULoadFactor 30<\/code><\/pre>\n\n\n\n
The CPU load factor caps how much processor a scan may consume, which keeps a scan from tanking latency on a busy web server.<\/p>\n\n\n\n
Defender also exposes two settings worth checking on a server that handles customer data. Cloud-delivered protection (MAPS<\/code>) submits samples to Microsoft for faster detection, and tamper protection stops malware from disabling the antivirus itself. On a VPS you manage over RDP, both are usually safe to enable:<\/p>\n\n\n\n
Set-MpPreference -MAPSReporting Advanced\nSet-MpPreference -EnableControlledFolderAccess Disabled   # only if your apps write to protected folders<\/code><\/pre>\n\n\n\n