Abstract:
A senior Microsoft engineer with more than 30 years of work experience recently reminded users not to run two real-time anti-virus software on the same Windows computer at the same time. What seems to be two layers of security protection may actually be counterproductive. It not only increases system resource consumption, but may also cause security software to misjudge each other, or even cause system failure.
Microsoft senior engineer Raymond Chen recently shared a troubleshooting case in a Windows 11 enterprise environment on Microsoft's official technology blog The Old New Thing. While investigating a complex system failure on a customer's computer, a colleague from an enterprise support team eventually discovered that the problem was caused by two anti-malware software installed on the system.
In this incident, two security software respectively used technology to modify the system function call path. When one of the software discovers that another software has called the system function it has taken over, it regards the other party's related process as a suspicious object and attempts to isolate it. At the same time, another software also took a similar action on the former.
As a result, two software programs that were originally designed to protect computer security began to interfere with each other and even tried to isolate the processes being used by the other party, ultimately causing chaos within the system.
Chen used a vivid metaphor to explain this phenomenon: two security companies that do not know each other are arranged to patrol at the same time in the same building. If both parties do not know the existence of the other, they may regard the other as an intruder. If they are lucky, they will only report suspicious situations; if the situation becomes complicated, they may take direct action to prevent the other party from carrying out normal tasks.
For ordinary users, this problem is not easy to find. Two anti-virus software may show that they are running normally, but in the background, they may be monitoring the same batch of files, processes and system operations at the same time. When one piece of software attempts to prevent another piece of software from performing a certain action, the end result may not be to protect the system, but to disrupt the normal operation of the system.
The problem goes beyond isolating processes from each other. Chen pointed out that some third-party anti-malware software uses so-called system function transfer technology, which means that the system function originally called by the program is transferred to the security software's own processing code.
This approach is not necessarily problematic in itself, as security software needs to be deep into the operating system to monitor potentially dangerous behaviors such as file access and process startup. However, when multiple security software uses similar technologies at the same time, complex calling relationships may arise between them.
For example, when one piece of software calls a certain system function, what is actually executed is the code inserted by another piece of software. The latter may consider the call dangerous and try to prevent the operation. If this process triggers other modified system functions again, a chain reaction may occur.
Chen pointed out that this type of interference may not only cause security software to misjudge, but may also cause program freezes, slow system response, and other problems that are difficult to diagnose. Users may mistakenly believe that the fault is caused by Windows updates, application defects or hardware problems, but in fact the root cause is a conflict between multiple security software.
Performance degradation is also a common risk of running multiple antivirus software at the same time. Real-time protection software requires continuous inspection of file read, write, download, and execution behavior. If two pieces of software monitor the same batch of operations at the same time, processor, memory, and disk resources may be consumed repeatedly.
Microsoft Defender that comes with Windows also requires certain system resources. In some cases, users may find that their anti-malware service consumes high CPU resources. If another real-time antivirus software is added, the system burden may be further increased, and file operations, application startup and overall response speed may be affected.
This type of problem is especially troublesome for enterprise environments. Corporate computers typically run large amounts of business software and are subject to centralized management policies. Once two security products conflict, administrators not only need to troubleshoot the operating system itself, but also check the logs, isolation records, and system function calls of the security software to find the real cause of the failure.
It is more difficult for ordinary home users to determine where the problem lies. If the computer suddenly freezes, the program cannot start, or the system is abnormal, users are likely to blame it on Windows updates or hardware aging, without thinking that the two security software are interfering with each other in the background.
Chen therefore advises not to install more anti-virus software as a simple way to improve security. Rather than having multiple real-time protection engines monitoring your system at the same time, choose a reliable security product and make sure it's functioning properly and up to date.
Microsoft has actually given clear suggestions on this issue. According to Microsoft's official support document, the company does not recommend that users run multiple real-time anti-virus or anti-spyware software at the same time, because this may affect computer performance and may also cause errors in software installation or updates.
Windows 11 already has Microsoft Defender Antivirus built-in and integrates multiple security features through the Windows Security Center. In addition to traditional virus and malware detection, the system also provides Microsoft Defender SmartScreen to assist in identifying dangerous websites, downloaded content and applications; some devices also support functions such as intelligent application control.
Windows Security also includes protection options against ransomware and potentially unwanted applications. For ordinary users who keep their systems updated, turn on default security settings, and download and run software carefully, these features can already cover many daily security risks.
Microsoft further emphasized in a support document released in April 2026 that the built-in security features of Windows 11 are generally sufficient to meet the daily needs of most users. The document describes Microsoft Defender as an excellent antivirus solution in 2026 and notes that additional installation of real-time antivirus software may increase resource consumption and compatibility issues.
However, Microsoft subsequently deleted this document and stopped publishing similar recommended content in June 2026. Microsoft has not publicly explained the reasons for this change in detail, so it cannot be concluded that the company has changed its judgment on the actual protection capabilities of Microsoft Defender.
Judging from the actual protection performance, Microsoft Defender is already different from earlier versions of Windows Defender. In recent years, the product has continued to add cloud threat detection, behavioral analysis and other security capabilities. Evaluations by the independent testing agency AV-TEST have also shown that Microsoft Defender achieved high protection scores in multiple test projects.
Of course, this does not mean that third-party anti-virus software has no value. Different security products may offer additional network protection, parental controls, privacy protection, identity monitoring or multi-device management capabilities. For users with specific needs, it still makes sense to choose a third-party security suite.
The key is that users need to distinguish between additional security features and re-running real-time antivirus engines. Installing a piece of software that includes a VPN, identity monitoring, or parental controls doesn't mean you have to have two real-time virus scanning engines working at the same time. Users should choose security products that suit their needs and let Windows manage the real-time protection status according to normal mechanisms.
For Windows 11 users who have installed third-party antivirus software, they should usually uninstall other real-time protection products that are no longer needed and confirm that Windows Security Center can correctly identify the security software currently in use. Under normal circumstances, when compatible third-party antivirus software takes over real-time protection, Microsoft Defender Antivirus will adjust its running status accordingly to avoid direct competition between the two real-time engines.
If users only want to perform a second security check occasionally, they do not necessarily need to install a second real-time antivirus software for a long time. On-demand scanning tools provided by Microsoft, such as Microsoft Safety Scanner, and Microsoft Defender Offline, can perform checks when needed without having to run simultaneously with another real-time protection product.
For enterprise users with higher security requirements, it still makes sense to deploy multiple layers of defense, but this usually needs to be achieved through a designed and verified security architecture, rather than simply superimposing multiple real-time antivirus engines on a computer. Measures such as firewalls, terminal detection and response systems, application control, system updates and backups can improve protection capabilities at different levels.
This failure case once again illustrates that network security is not about having more security software, the better. Effective protection requires components to work together and anomalies to be clearly diagnosed and managed when they occur.
For most Windows 11 home users, keeping the system and applications updated, enabling Microsoft Defender and related default security features, handling unknown downloads with caution, and using a reliable backup solution is usually more reasonable than running two real-time antivirus software at the same time.
If you really need a third-party security product, users don't have to reject it just because it is not Microsoft's own software. What really matters is choosing a product that suits your needs, avoiding unnecessary duplication of functionality, and ensuring that security software doesn't conflict with one another.
Ultimately, the goal of antivirus software is to stop malicious programs from damaging your system, not to have different protection engines fighting each other for control. As Raymond Chen emphasized, arranging multiple security software that does not understand each other to work on the same computer at the same time may cause unexpected troubles. For ordinary users, establishing a stable, timely updated and reasonably configured protection system is far more important than simply increasing the number of anti-virus software.
Comments