Direct answer
Identify the endpoint's intended antivirus provider, confirm its current protection state, and compare that state with the organization's policy. Microsoft Defender Antivirus can run in different modes, so an inactive Defender status alone does not prove the machine has no antivirus.
Find the intended security provider
Open Windows Security, choose Virus & threat protection, then Manage providers under Who's protecting me. Record the provider and compare it with the organization's endpoint inventory. A third-party antivirus may be the intended primary product.
If a scan reports an unknown state, check whether the scan had sufficient access and whether the product reports its status through the relevant Windows interfaces. Unknown is a request for verification, not proof that protection is absent.
Reference: Microsoft: Defender Antivirus on Windows and how to check its state.
Interpret Defender's running mode
For Microsoft Defender Antivirus, run Get-MpComputerStatus in PowerShell and inspect AMRunningMode. Microsoft describes Normal as active mode; passive modes can occur in supported configurations when another product is primary. Consult the provider's management console for the actual primary product's health.
Also check the applicable protection and security intelligence status in the provider's interface. A provider name by itself does not establish that its protections are current or operating as intended.
Reference: Microsoft: Defender Antivirus on Windows and how to check its state.
Investigate a mismatch
If the registered provider or running mode differs from policy, capture the device name, scan time, product name and reported mode. Check the management console for pending deployment, an expired license, stale reporting, policy conflicts or recent changes before attempting a fix.
- Confirm the endpoint has the expected product and is checking in to its management service.
- Review protection alerts and security intelligence currency through the provider's supported interface.
- Escalate persistent errors to the endpoint owner; do not disable another product to force a particular mode.
Verify the repair
Use the organization's approved deployment or support procedure to restore protection, then verify the provider, current status and management check-in. Record the before and after evidence and any outstanding alert. Schedule a fresh authorized posture scan to confirm what the scanner can observe.
Assessment limits
A posture snapshot cannot establish that malware is absent, that every protection component is healthy or that detection will succeed. Provider registration, permissions and supported OS configurations affect what can be observed.
Frequently asked questions
Does Defender passive mode mean no antivirus is running?
Not necessarily. Passive mode can be part of a supported configuration with another primary antivirus. Verify that provider's health and the intended policy.
Does an enabled antivirus prove a computer is clean?
No. An enabled status describes configuration at a point in time, not a complete compromise assessment or a guarantee of detection.
What should I do with an unknown antivirus result?
Verify the provider locally and in the management console, check scan permissions and escalate unresolved visibility gaps. Do not silently interpret unknown as protected.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.