Windows Defender PUP Scan: How to Check for Potentially Unwanted Programs

Enhancing Windows Defender's Capabilities

Windows Defender, integrated directly into Windows 10, functions as a malware and virus scanner. While it offers adequate protection against common threats, its effectiveness can be increased.

Specifically, configuring it to scan for Potentially Unwanted Programs (PUPs) – such as browser toolbars, adware, and other forms of unwanted software – provides a more comprehensive security approach.

Understanding Windows Defender's Role

Windows Defender is designed to deliver fundamental, integrated virus protection for Windows operating system users. A key benefit, beyond its built-in nature, is its user-friendliness and lack of intrusive notifications.

However, it may not always represent the optimal solution. Numerous third-party antivirus programs offer superior protection, with some available at no cost.

Many of these alternatives also include PUP scanning capabilities. Nevertheless, if a user prefers to utilize Windows Defender, enhancements can be implemented to broaden its functionality.

Adding PUP Scanning to Windows Defender

To improve Windows Defender, consider enabling the scanning of Potentially Unwanted Programs. This will help identify and remove unwanted software that might otherwise slip through standard virus scans.

Here's how to add this useful functionality to your existing Windows Defender setup. This proactive step can significantly bolster your system's overall security posture.

Related: What's the Best Antivirus for Windows 10 and 11? (Is Microsoft Defender Good Enough?)

Activating PUP Scanning within Windows Defender via Registry Modification

A straightforward Registry adjustment is all that’s required to enable this feature. The question arises: why resort to a manual modification? Currently, this capability is primarily geared towards enterprise-level users. It’s possible this functionality could be extended to all users in subsequent updates, or it might be removed altogether. However, given the consistent nature of Windows Defender across all installations, activation and utilization are presently possible.

Related: Procedures for Backing Up and Restoring the Windows Registry

A standard disclaimer: The Registry Editor is a potent system tool, and improper use can lead to system instability or render your system unusable. This particular modification is relatively simple, and adherence to the provided instructions should prevent issues. Nevertheless, if you are unfamiliar with its operation, familiarize yourself with Registry Editor usage before proceeding. Furthermore, it’s crucial to create a Registry backup (and a full system backup!) prior to making any alterations.

Begin by launching the Registry Editor. Press the Start button and type “regedit.” Press Enter to open the Registry Editor and grant it permission to modify your PC’s settings. Within the Registry Editor, utilize the left-hand navigation pane to access the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

Subsequently, a new subkey will be created under the Windows Defender key. Right-click on the Windows Defender icon and select New > Key. Assign the name "MpEngine" to this newly created key.

Now, a new value must be established within the MpEngine key. Right-click the MpEngine icon and select New > DWORD (32-bit) Value. Name this new value "MpEnablePus."

The next step involves modifying this newly created value. Double-click the "MpEnablePus" value and enter "1" into the "Value data" field.

Confirm your changes by clicking OK, exiting the Registry Editor, and then restarting your computer. Following this, Windows Defender will notify you with a standard pop-up alert whenever a PUP is detected.

To investigate the specifics of any blocked PUP, simply launch Windows Defender, navigate to the History tab, and then select the "All detected items" option.

Should you wish to disable PUP scanning within Windows Defender, reopen the Registry Editor and either set the "MpEnablePus" value to 0 or delete the value entirely. A subsequent computer restart will then apply the changes.

Utilize Our One-Click Registry Modification

For users who prefer to avoid manual adjustments within the Registry, we have developed two readily available registry modifications. These tools allow for the activation and deactivation of potentially unwanted program (PUP) scanning within Windows Defender.

Downloadable Registry Hacks

Both modifications are packaged within a single ZIP archive. To implement a change, simply double-click the desired file, proceed through the confirmation prompts, and subsequently restart your computer to apply the settings.

Windows Defender PUP Hacks are now available for download.

Further Reading: A Guide to Creating Your Own Windows Registry Hacks

How the Hacks Function

These modifications essentially represent the newly created MPEngine key, exported into a .REG file format. Activating PUP scanning through the provided hack introduces the key and the MpEnablePus value, configuring it to '1'.

Conversely, disabling PUP scanning via the corresponding hack sets the MpEnablePus value to '0'. For those inclined towards Registry customization, acquiring the skill to create personalized Registry hacks is a worthwhile endeavor.

Understanding the underlying mechanism empowers users to tailor their system settings with precision.

These one-click solutions offer a streamlined approach to managing PUP scanning in Windows Defender.