Chen's latest post on Microsoft's developer blog is titled "If one anti-malware software is good, does that make two better?" Spoiler: no.
What happened: two security products, one confused PC
Neowin reported the post. According to that account, one of Chen's colleagues on Microsoft's enterprise support team spent a long time debugging a complicated failure. The cause turned out to be two antivirus products running on the same system.
Chen used placeholder names for the two vendors. Microsoft has used these names for years: Chen once explained that a sample corporation is typically called Contoso or Fabrikam. The real products were not named.
As Neowin describes it, the conflict went like this:
- Fabrikam called a function that Contoso treated as suspicious.
- Contoso did the same thing in reverse, and Fabrikam treated that as suspicious.
- Each product tried to quarantine the other's activity, and the host system ended up with the damage.
Chen compares it to hiring two security companies to guard the same floor without telling either one the other exists. Each guard sees the other as the intruder.
Section summary: The real-world case was an enterprise support ticket. Two unnamed security products each treated the other's behavior as hostile, and that mutual suspicion made the system fail.
Why antivirus suites clash: hooks and detours
The anecdote is less interesting than Chen's technical explanation. Neowin quotes him saying that anti-malware software often does things Windows doesn't officially support, such as detouring system functions.
Detouring means the security product inserts itself into the path of a Windows API call. When an app thinks it is calling a normal system function, it may actually be calling the antivirus product's code first. That code can inspect the call, block it, or do something unrelated. Chen notes that this unrelated work can cause problems of its own, including hangs.
Now picture two products doing this at the same time:
- Product A detours a system function so it can watch what programs do.
- Product B detours the same area, or watches Product A's code-injection behavior.
- To each product, the other's injection and interception look like malware techniques, because these are the same tricks malware uses.
- Each one blocks or quarantines the other, and normal system calls get caught in the middle.
The likely result is crashes, hangs, and failures that are very hard to diagnose. That fits Chen's description of a support engineer spending a lot of time to find the cause.
Section summary: Real-time security tools work by intercepting system behavior. Two interceptors with no knowledge of each other can look like attackers to one another.
Microsoft's official guidance says the same thing
This isn't just one engineer's opinion. Microsoft's support FAQ on antivirus and anti-malware software, which applies to Windows 11, says:
- Microsoft recommends that you not run other antivirus or antispyware products at the same time as Microsoft Defender.
- Running more than one real-time security product can hurt your PC's performance.
- You may see installation or update errors, such as 0x80070643.
- If you switch to Microsoft's security software, you should uninstall your previous security product and then run the Microsoft Safety Scanner to check for leftover malware.
The FAQ also makes an important distinction: on-demand scanners are fine. Microsoft Safety Scanner and Microsoft Defender Offline can be installed alongside any real-time security product, because they only run when you start them or on a schedule you set. A second opinion is allowed. A second full-time guard is not.
Section summary: Microsoft's documentation warns against running real-time products side by side and names a specific update error. On-demand scanners are an explicit exception.
Defender steps aside, and comes back
Some readers will worry that installing a third-party suite leaves Defender running underneath it. Microsoft's FAQ says Defender Antivirus is built into Windows 10 and Windows 11 and can be turned off if you choose another security product.
The FAQ includes two safeguards:
- If you turn off Defender and have no other security product, your device is exposed to malware.
- If no other product is installed, or the one you have has expired, Defender turns itself back on automatically.
So the design is already one real-time product at a time. Problems tend to start when users or admins work around that, for example by leaving an old suite half-removed, or by installing a second third-party product next to a first one. Chen's Fabrikam-versus-Contoso case was two non-Microsoft products, so this isn't simply about Defender versus everyone else.
Practical checklist: running a single antivirus product
Based on Microsoft's published guidance, here is a sensible approach for home users and IT staff:
- Choose one real-time antivirus product. Defender, a third-party suite, or your organization's standard product are all fine. Just pick one.
- Fully uninstall the old product when you switch, as Microsoft advises, instead of disabling it and leaving it in place.
- Run an on-demand scan after switching. Microsoft suggests Microsoft Safety Scanner. Defender Offline is another on-demand option for stubborn infections.
- Confirm the new product is running before you rely on it. To check Defender's status, type "Security" in Start, open Windows Security, and go to Virus & threat protection. Microsoft's own step-by-step route in its FAQ still uses Windows 10-era Settings labels, so the Windows Security app is the more reliable starting point.
- Look for warning signs of overlap. Microsoft names error 0x80070643 during installs or updates. Unexplained slowdowns, hangs, or failed updates after installing security software are worth checking too.
- Keep second opinions on-demand. If you want another scanner, use a tool that only runs when you ask it to, not another real-time engine.
Caveats
There are a few limits to this story:
- It is one anecdote. Neowin's account doesn't include the affected Windows version, the specific symptoms, or how the case was fixed. Neowin guessed that Microsoft might have contacted both vendors or told the customer to remove one product, but that is speculation, not a reported outcome.
- Not every pair of products will clash this badly. The mechanism Chen describes explains how conflicts happen. It doesn't mean every combination fails.
- It is not a verdict on Defender versus third-party vendors. Neowin notes that Microsoft no longer claims Defender is the only antivirus you need. Microsoft's FAQ explicitly allows you to choose another product. The rule is about how many real-time products you run, not which brand.
There is also an enterprise lesson in the story. A skilled support engineer can lose many hours to a failure that the software inventory would have explained right away. Before you capture memory dumps, check how many security agents are installed.
The bottom line
Running two real-time antivirus products on Windows usually doesn't add protection. Each one hooks into the system, and each can mistake the other for malware. Chen's support story shows how that plays out, and Microsoft's FAQ gives the same advice: run one real-time product, uninstall the old one when you switch, and use on-demand scanners if you want a second opinion.
Have you run into a conflict between two security suites on Windows 10 or Windows 11? Share your stories, including any error codes, in the forum.