Windows Defender - Windows Vista-specific Functionality

Windows Vista-specific Functionality

Windows Defender had additional functionality in Windows Vista which was removed in subsequent versions of Windows.

Security agents

Security agents monitor the computer for malicious activities

• Auto Start - Monitors lists of programs that are allowed to automatically run when the user starts the computer
• System Configuration (settings) - Monitors security-related settings in Windows
• Internet Explorer Add-ons - Monitors programs that automatically run when the user starts Internet Explorer
• Internet Explorer Configurations (settings) - Monitors browser security settings
• Internet Explorer Downloads - Monitors files and programs that are designed to work with Internet Explorer
• Services and Drivers - Monitors services and drivers as they interact with Windows and programs
• Application Execution - Monitors when programs start and any operations they perform while running
• Application Registration - Monitors tools and files in the operating system where programs can register to run at any time
• Windows Add-ons - Monitors add-on programs for Windows

Software Explorer

The Advanced Tools section allows users to discover potential vulnerabilities with a series of Software Explorers. They provide views of startup programs, currently running software, network connected applications, and Winsock providers (Winsock LSPs). In each Explorer, every element is rated as either "Known", "Unknown" or "Potentially Unwanted". The first and last categories carry a link to learn more about the particular item, and the second category invites users to submit the program to Microsoft SpyNet for analysis by experts. The Software Explorer feature has been removed from Windows Defender in Windows 7, for which Microsoft recommends using AutoRuns for controlling which programs run when the computer starts.

Notification of startup programs that run as an administrator

Windows Defender in Windows Vista automatically blocks all startup items that require administrator privileges to run (this is considered suspicious behavior for a startup item). This automatic blocking is related to the UAC (User Account Control) functionality in Windows Vista, and requires users to manually run each of these startup items each time they log in.