Windows Server / Services, IIS & Secure Operations
Check Windows Server antimalware mode before investigating exclusions
Protection behavior can differ when another endpoint-security product or managed mode is active. Collect actual state first.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdatedRead the result
With Defender tools available, these fields describe reported protection state. Expected mode depends on the supported security stack and policy.
Resolve and verify
Compare the state with the endpoint-management record and security alerts. Repair policy or update failures through the security owner and validate the application separately.
Before changing production
Do not add broad server-volume exclusions or disable protection to mask an unexplained application failure.