Malwarebytes vs Microsoft Defender: Do You Need Both on the Same PC?

Fix it now

Microsoft’s documentation settles the second half of this question: if another antivirus product is installed and working, Microsoft Defender Antivirus turns itself off. Not passive, off. So Malwarebytes with real-time protection enabled replaces Defender rather than joining it, and the pairing people describe as free and safe is Defender plus Malwarebytes used as a scanner, because scanning is what the free build does.

1. Keep Defender and add the free Malwarebytes app if you want a second opinion at no cost. Real-Time Protection, Web Protection and Malware Protection are all paid features, so the free build cannot take the antivirus role.
2. Buy Malwarebytes if you want its real-time layers – Web Protection, Malware Protection, Ransomware Protection and Exploit Protection on Windows – and accept that Defender stands down when you do.
3. Skip the purchase for remote desktop defence. Malwarebytes publishes Remote Desktop Monitoring, which alerts you when remote desktop programs are found on the device, and it is in the free feature list.
4. Skip it if you were told limited periodic scanning gives you both. Microsoft says that feature uses only a small part of Defender and cannot detect most malware or unwanted software.
5. Do not install Malwarebytes alongside a third antivirus. Malwarebytes publishes that running it with another antivirus can cause blocking, loss of internet connectivity and system crashes.

Check which product is actually protecting the machine in Windows Security, under Virus & threat protection, where Windows names the current provider. Get-MpComputerStatus | select AMRunningMode tells you what Defender itself is doing; Microsoft documents the values as Normal, Passive and EDR Block Mode, and passive mode applies to endpoints onboarded to Defender for Endpoint rather than to a home PC.

If that answers it, you can stop. Below is why Windows behaves this way, what each product’s free and paid tiers actually contain, and when paying is the right call.

Why it happens

The version of this story most people have heard is that Windows lets a third-party antivirus take over and puts Defender into passive mode, where it can still run scheduled scans as a second opinion. That is true on a managed enterprise endpoint and wrong on a home PC, and the difference matters because the whole appeal of the pairing rests on it.

Microsoft’s compatibility documentation splits the outcomes by whether the device is onboarded to Microsoft Defender for Endpoint. On a Windows 10 or 11 device that is onboarded, a non-Microsoft antivirus puts Defender into passive mode automatically. On a device that is not onboarded – which is every ordinary home and small-office PC – the documented outcome is disabled mode. The limited periodic scanning page says the same thing in plainer words: if another antivirus product is installed and working, Microsoft Defender Antivirus turns itself off.

There is a consumer-facing consolation prize, and it is worth knowing exactly how small it is. Limited periodic scanning is a toggle in Windows Security, under Virus & threat protection, beneath the name of the non-Microsoft product, in a section called Microsoft Defender Antivirus options. Microsoft’s own description of it is that it uses only a small part of Microsoft Defender Antivirus to find threats and cannot detect most malware or unwanted software, and that Microsoft does not support the feature in enterprise settings. It is a periodic sweep, not a second engine.

What is left is a straightforward question about one machine. Defender is built into Windows, updated with it, and costs nothing. Malwarebytes’ paid build adds browser-independent web filtering, behavioural ransomware protection and exploit protection for browsers and document readers. Neither of those lists is a reason to run both, because you cannot: the moment one takes the real-time role, the other stops doing it.

Full reference

What Windows actually does when a second antivirus arrives

In passive mode Microsoft documents that scheduled scans are not run and a configured schedule is ignored, apart from catch-up quick scans and the quick scan that follows a security intelligence update. That is another reason not to treat a standing-down Defender as a working second layer.

Free against paid, in both products

Where each one earns its place

Defender is a serious product with the Microsoft telemetry estate behind it, tight integration with Windows, tamper protection to stop malware disabling it, and cloud-delivered detection. On a patched machine used by someone who does not install random downloads, it is a reasonable single layer at no cost. If you keep documents you cannot replace, turn on controlled folder access, because that is Defender’s ransomware defence and it waits until you ask for it.

Malwarebytes grew up as a remediation tool for the category people actually meet: adware, browser hijackers, bundled toolbars, aggressive optimiser software and the grey zone of potentially unwanted programs. It is still the tool most technicians reach for on a machine that has been thoroughly messed with, and the free build does that job without displacing anything. The subscription buys real-time layers, and it is those – not the scanner – that you are paying for.

Checking which product is live

1. Open Windows Security and go to Virus & threat protection. Windows names the current antivirus provider there.
2. If a non-Microsoft product is named, look beneath it for Microsoft Defender Antivirus options, which is where limited periodic scanning lives.
3. In PowerShell, run Get-MpComputerStatus | select AMRunningMode to see what Defender itself reports.
4. Do not assume a green tick in one product means the other is doing nothing harmful. Two real-time products fighting over the same files is exactly what Malwarebytes warns produces blocking, connectivity loss and crashes.

One machine, one decision

• One careful adult, patched Windows, nothing exposed: Defender, with the free Malwarebytes app installed for occasional scans. This costs nothing and is the right starting point.
• A shared family PC where software appears on its own: pay for Malwarebytes and let it take the real-time role, knowing Defender turns itself off.
• You are cleaning up a machine right now: run the free scanner first and decide about a subscription once the machine is clean.
• Remote desktop reachable from the internet: close it. Then decide about antivirus.
• Several machines for a business: neither consumer choice fits well. A managed endpoint product with a central console is the right shape.

Questions people ask about this