How to Check Whether a Windows 11 PC Has Actually Been Compromised
Your Windows 11 PC suddenly behaves strangely.
The fans run harder than usual. An unfamiliar process appears. Microsoft Defender raises an alert. Your browser redirects somewhere unexpected, or you receive a Microsoft 365 authentication request you never initiated.
Has the PC genuinely been compromised?
Or is Windows simply:
installing updates
indexing files
synchronising OneDrive
scanning with Defender
updating applications
performing legitimate background maintenance
There is no single button that can prove a Windows PC is completely safe.
A proper compromise assessment combines evidence from the device, user accounts, Microsoft 365, email, security tools and network.
And if an attack may still be active, the first priority is not scanning.
It is containment.
First: Don't Treat Every Slow PC as Hacked
High CPU usage or lots of Task Manager processes are not evidence of compromise by themselves.
Windows 11, Microsoft 365, browsers, OneDrive, security software and hardware-management tools can all run numerous background processes legitimately.
Concern should rise when several suspicious indicators occur together.
For example:
Slow PC alone: probably needs investigation.
Slow PC + Defender disabled + unknown administrator account + unfamiliar Microsoft 365 sign-ins: potentially serious security incident.
Record:
what happened
when it started
who was signed in
any Defender alerts
recent downloads or support calls
whether other users are affected
whether unusual authentication activity has appeared
A timeline becomes extremely useful if the problem turns out to be genuine.
Warning Signs That Deserve Immediate Attention
Take the situation more seriously if you see:
ransomware or credential-stealer detections
Defender disabled unexpectedly
unfamiliar antivirus exclusions
unknown administrator accounts
unexpected MFA requests
passwords changing unexpectedly
unfamiliar Microsoft 365 sign-ins
unapproved remote-access software
browser extensions returning after removal
PowerShell windows appearing without explanation
files suddenly changing extension
ransom notes
customers receiving messages you didn't send
unknown Outlook forwarding rules
new mailbox delegates or administrators
similar suspicious behaviour across multiple computers
One clue may have an innocent explanation.
Several together usually deserve proper incident investigation.
1. If the Attack May Be Active, Contain It First
If files are actively being encrypted, accounts appear to be under somebody else's control or the problem appears to be spreading:
Stop normal use of the PC.
For an unmanaged machine:
1. Disconnect Ethernet.
2. Turn off Wi-Fi.
3. Disconnect VPN.
4. Disconnect unnecessary external drives.
5. Do not attach backup storage.
6. Contact IT using another trusted device.
The NCSC recommends disconnecting infected devices from network connections to reduce the potential for further damage or spread.
For a business using Microsoft Defender for Endpoint, IT may instead isolate the device remotely. Microsoft says device isolation restricts network communication while maintaining connectivity to Defender for Endpoint so the security team can continue investigating it.
That can be preferable to an employee manually experimenting with the machine.
2. Preserve Evidence Before You Start “Cleaning”
This is a point I would strengthen considerably.
If the incident may be serious, don't immediately delete every suspicious file or reset Windows.
Useful evidence can include:
Defender detection names
timestamps
screenshots
suspicious email messages
unfamiliar applications
file paths
ransom notes
account sign-in records
IP addresses
browser history
relevant logs
Deleting everything first can make it much harder to answer:
How did the attacker get in?
What did they access?
Are other computers affected?
Did they steal credentials?
Could the same attack happen again?
For a serious business compromise, containment and evidence collection should normally come before aggressive cleanup.
3. Check Microsoft Defender
Open:
Windows Security > Virus & threat protection
Confirm which antivirus provider is active.
If Microsoft Defender is supposed to be protecting the computer, check that:
real-time protection is enabled
cloud-delivered protection is enabled
security intelligence is current
tamper protection is enabled
no unexpected warning is present
An unexplained security product being disabled is much more significant than a PC simply feeling slow.
Review Protection History
Open:
Windows Security > Virus & threat protection > Protection history
Look for:
detected malware
failed remediation
threats that were allowed
potentially unwanted applications
security controls being disabled
recurring detections
Record the:
detection name
file path
timestamp
action taken
before changing anything.
A detection marked Remediated does not necessarily mean the whole incident is over.
A credential-stealing Trojan could have captured passwords before Defender removed it.
4. Check for Suspicious Defender Exclusions
Open:
Virus & threat protection > Manage settings > Exclusions
Broad unexplained exclusions deserve investigation.
Examples might include:
C:\
C:\Users
C:\Windows
or whole temporary/script directories.
Legitimate business software can require antivirus exclusions, so don't automatically remove them on a managed PC.
But somebody should be able to explain why each exclusion exists.
Attackers sometimes weaken protection rather than disabling Defender completely.
5. Update Defender and Scan Appropriately
If the situation is not an active incident requiring forensic handling, update Defender and scan.
Microsoft recommends scanning when you suspect malware or want to confirm that a previous infection appears to have been removed.
Start with a Quick scan for ordinary suspicion.
Use a Full scan where stronger indicators exist.
For persistent threats, Microsoft Defender also provides Offline scan, which restarts the computer and scans outside the normal Windows session.
But remember:
A clean scan is evidence. It is not proof that compromise never occurred.
6. Check Recently Installed Applications
Go to:
Settings > Apps > Installed apps
Sort or review by installation date.
Look particularly for:
unfamiliar remote-support software
browser assistants
unknown VPN clients
screen-sharing software
cryptocurrency miners
questionable “driver updater” utilities
applications installed during a suspicious support call
Remote-access software isn't automatically malicious.
Tools legitimately used by IT support can also be abused by scammers.
The question is:
Who installed it, when and why?
7. Review Accounts and Administrators
Open:
Settings > Accounts > Other users
Investigate:
accounts nobody recognises
old support accounts
former employee accounts
standard users unexpectedly promoted to administrator
accounts created around the suspected compromise date
An unknown administrator account is a serious finding.
Do not simply delete it and assume the incident is over.
An attacker with administrator access may have made many other changes.
8. Check Browser Extensions and Fake Notifications
Not every scary popup is malware.
A website granted browser-notification permission can display convincing fake virus alerts even after you've left the site.
Review each browser's:
extensions
site notification permissions
search engine
homepage
startup pages
proxy configuration
Investigate extensions you don't recognise.
And never telephone a number displayed by a random browser warning claiming your computer is infected.
9. Check the User's Identity From Another Trusted Device
This is one of the most important additions to any endpoint investigation.
A PC can be completely clean while the user's account is already compromised.
For Microsoft personal accounts, review recent account activity.
For Microsoft 365 work accounts, review recent sign-ins and involve IT so Microsoft Entra logs can be checked more deeply.
Look for:
successful sign-ins you don't recognise
unfamiliar devices
unexpected MFA activity
authentication-method changes
password resets
suspicious geographic or network patterns
Don't rely solely on geography.
VPNs, corporate networks and mobile providers can make legitimate sign-ins look unusual.
Look at the combination of:
time + device + authentication method + location + user behaviour.
10. Check Microsoft 365 Mailbox Persistence
Changing a password may not remove everything an attacker configured.
Inspect:
Inbox rules
automatic forwarding
mailbox delegates
Sent Items
Deleted Items
connected applications
registered authentication methods
Attackers may create rules that:
forward financial conversations
hide security warnings
delete replies
monitor invoices
conceal password-reset messages
For businesses, Microsoft 365 audit information is much more useful than simply examining what appears in Outlook.
A compromised mailbox is an identity incident, not merely an email problem.
11. Check for Ransomware
Immediate ransomware indicators include:
large numbers of files changing rapidly
documents becoming unreadable
unfamiliar file extensions
ransom notes
network shares suddenly failing
backup errors
security products being disabled
If ransomware is present:
Contain first.
Do not connect backup storage.
Do not immediately start restoring files to systems that may still be compromised.
The NCSC advises recovering only onto environments you are confident are clean and verifying that backups are not infected before restoration.
12. A Clean Antivirus Scan Does Not Prove the PC Wasn't Compromised
This should be one of the article's central messages.
A clean scan can tell you:
Defender did not detect known active malware at that moment.
It cannot prove:
malware was never present
credentials weren't stolen
data wasn't copied
an attacker didn't use legitimate remote tools
Microsoft 365 wasn't accessed
malicious mailbox rules weren't created
persistence hasn't been missed
another PC isn't compromised
Modern attackers increasingly use legitimate credentials and legitimate administrative tools.
That can leave little conventional malware behind.
So the correct question isn't merely:
“Does antivirus find anything?”
It is:
“What evidence exists across endpoint, identity, email and network activity?”
13. When Should You Rebuild Windows?
Sometimes trying to clean the system is not worth the uncertainty.
A controlled rebuild becomes attractive when:
a backdoor or remote-access Trojan was present
an attacker obtained administrator/SYSTEM access
security controls were deliberately disabled
persistence mechanisms are found
ransomware affected the PC
malware repeatedly returns
system integrity cannot be established
the device handled particularly sensitive information
regulatory or contractual requirements demand a stronger assurance level
The NCSC says that if antivirus cannot reliably clean an infected device, wiping it and reinstalling the operating system may be necessary.
For ransomware recovery, the NCSC likewise recommends safely wiping infected devices and reinstalling the operating system before restoring clean data.
Don't Restore the Problem
Before rebuilding, preserve essential business data carefully.
But do not blindly copy the entire old user profile—including every script, extension and application-data directory—back onto the clean machine.
You may simply reintroduce the same unwanted configuration.
Restore required data deliberately.
What Not to Do
Avoid installing several antivirus products because you think “more scanners = more certainty”.
Avoid random malware-removal utilities.
Don't change important passwords on a computer you suspect contains a keylogger.
Don't attach backup drives to an actively compromised system.
And don't factory-reset the PC before considering whether the incident involves:
stolen credentials
Microsoft 365 sessions
mailbox rules
other devices
data theft
Resetting one laptop does not undo everything an attacker may already have done elsewhere.
A Better Compromise Checklist
For a suspected Windows 11 compromise, I would simplify the process to:
1. Decide whether the attack may still be active.
2. Contain the PC immediately if necessary.
3. Preserve useful evidence.
4. Check Defender health, history and exclusions.
5. Update security intelligence and run appropriate scans.
6. Review recently installed software and administrator accounts.
7. Inspect browsers for suspicious extensions and permissions.
8. From a trusted device, review account sign-ins and MFA.
9. Check Microsoft 365 mailbox rules, forwarding and delegated access.
10. Look for ransomware or unusual file activity.
11. Check whether other users or devices show similar indicators.
12. Decide whether the PC can genuinely be trusted again.
13. Rebuild it when integrity cannot be established.
14. Reset credentials and revoke sessions from a trusted environment.
15. Fix the route the attacker originally used.
That is easier to follow than treating compromise assessment as 24 independent checks.
Prevention After Recovery
Once the incident is contained, ask:
Why did it happen?
Potential routes include:
phishing
stolen passwords
weak MFA
unpatched software
malicious attachments
remote-access tools
exposed services
compromised suppliers
another infected device
Then strengthen the relevant controls.
For a business, that might include:
phishing-resistant MFA/passkeys
Microsoft Defender for Business
Defender for Endpoint
Conditional Access
Microsoft Intune
least privilege
application control
patch management
security monitoring
tested backups
staff awareness
Incident response should end with risk reduction, not simply the disappearance of a warning.
How Hamilton Group Can Help
Checking whether a Windows 11 PC has genuinely been compromised requires much more than running an antivirus scan.
Hamilton Group can investigate the endpoint alongside the user's Microsoft 365 identity, mailbox, security configuration and wider business environment.
We can help with:
rapid containment
Microsoft Defender investigations
endpoint detection and response
suspicious account activity
Microsoft Entra sign-ins
mailbox compromise
ransomware
credential theft
Windows rebuilds
root-cause analysis
long-term security improvements
Hamilton Group aims to make first contact on IT support requests within 15 minutes, so businesses can get experienced guidance quickly when something genuinely suspicious happens.
Visit hgmssp.com or call 0330 043 0069 to discuss a suspected compromise.