How to Check Whether a Windows 11 PC Has Actually Been Compromised

30 Jul 2026

Your Windows 11 computer suddenly feels slower. The fans are running harder, an unfamiliar process appears in Task Manager or Microsoft Defender displays a security warning.

Has somebody actually compromised the computer—or is Windows simply installing updates, synchronising OneDrive or dealing with a badly behaved application?

The distinction is important.

Treating every performance problem as a cyberattack can cause unnecessary panic and lead to damaging attempts to “clean” the computer. However, ignoring genuine warning signs can give an attacker more time to steal passwords, access email, move through a business network or encrypt important files.

There is no single button that can prove a Windows computer is completely safe. A proper investigation combines information from the device, its user accounts, cloud services, security software and network activity.

Hamilton Group’s experienced IT and cybersecurity team can carry out these checks properly. We do not simply run one antivirus scan and declare the problem solved. We investigate what happened, determine what may have been accessed, contain the risk and help prevent the same route of attack from being used again.

Strange Behaviour Does Not Automatically Mean Malware

Many legitimate Windows activities can look suspicious.

A computer may temporarily become slow because Windows is:

Installing an update
Indexing documents for Windows Search
Synchronising files with OneDrive
Running a Microsoft Defender scan
Downloading application updates
Creating previews and thumbnails
Completing a backup
Updating a graphics or chipset driver
Running several browser or Teams processes

A high number of entries in Task Manager is not automatically evidence of compromise. Windows, Microsoft 365, security software and hardware-management utilities can each run several related background processes.

The NCSC lists slow computers, users being locked out, inaccessible documents, redirected searches, strange messages and unusual account activity as possible signs of an incident. These are indicators that require investigation—not proof by themselves. (National Cyber Security Centre⁠)

Look for a Pattern, Not One Isolated Symptom

Concern should increase when several related events occur together.

For example, a slow computer may simply be busy. A slow computer combined with a disabled antivirus, an unknown administrator account and unfamiliar Microsoft 365 sign-ins is considerably more serious.

Record:

What happened
When it started
Which user was signed in
Which applications were running
Whether any warning appeared
Whether other computers are affected
Whether accounts have shown unusual activity

This information can help distinguish a Windows problem from an active security incident.

Warning Signs That Need Immediate Attention

The following signs deserve prompt investigation:

Microsoft Defender detects a Trojan, credential stealer, backdoor or ransomware.
Real-time protection or tamper protection has been disabled unexpectedly.
An unknown antivirus exclusion has appeared.
An unfamiliar administrator account exists.
You receive multifactor authentication prompts you did not initiate.
Passwords have changed without your involvement.
Microsoft account or work-account sign-ins appear from unfamiliar locations.
Browser searches are redirected.
Unknown browser extensions return after removal.
Remote-access software has been installed without approval.
Applications open or close by themselves.
PowerShell or Command Prompt windows repeatedly flash without explanation.
Security websites cannot be opened.
Files have unfamiliar extensions or will no longer open.
A ransom note appears.
Customers or colleagues receive messages you did not send.
Outlook contains unfamiliar forwarding or inbox rules.
Money, gift-card or bank-detail requests have been sent from a company mailbox.
New users, mailbox delegates or Microsoft 365 administrators have appeared.
The same suspicious behaviour is occurring across several computers.

Ransomware may encrypt, delete or steal data and can also threaten to publish information taken from the victim. (National Cyber Security Centre⁠)

If an Attack May Be Active, Contain It First

If files are actively being encrypted, accounts are being used by somebody else or the problem appears to be spreading, do not continue using the computer normally.

Disconnect the affected device from the network:

Unplug its Ethernet cable.
Turn off Wi-Fi.
Disconnect it from any VPN.
Disconnect unnecessary external drives.
Do not connect backup media.
Avoid signing into additional accounts.
Contact your IT provider from a different, trusted device.

The NCSC recommends immediately disconnecting an infected device from wired, wireless and mobile network connections to limit further damage or spread. (National Cyber Security Centre⁠)

For a business computer, avoid immediately wiping the device or randomly deleting suspicious files. This can destroy valuable evidence needed to establish:

How the attacker entered
Which account was used
What information may have been accessed
Whether other devices are affected
Whether the threat can return

Do not reconnect the computer merely because one antivirus scan reports that it is clean.

Check One: Confirm That Antivirus Protection Is Active

Open:

Windows Security > Virus & threat protection

Check for warnings stating that protection is disabled or another antivirus provider is managing the computer.

Select:

Manage providers

Confirm which antivirus product is currently registered.

If Microsoft Defender is the active provider, verify that:

Real-time protection is enabled.
Cloud-delivered protection is enabled.
Security intelligence is current.
Tamper protection is enabled.
No warning requires attention.

Microsoft Defender is built into Windows and can use behaviour monitoring, cloud protection and anomaly detection alongside conventional malware signatures. (Microsoft Learn⁠)

Check Defender with PowerShell

Open PowerShell as an administrator and run:

Get-MpComputerStatus |

Select-Object AMRunningMode,

AntivirusEnabled,

RealTimeProtectionEnabled,

BehaviorMonitorEnabled,

IsTamperProtected,

AntivirusSignatureLastUpdated

Microsoft documents Get-MpComputerStatus as the command for checking Microsoft Defender Antivirus status and protection settings. (Microsoft Learn⁠)

On an ordinary Windows 11 computer using Defender as its primary antivirus, you would normally expect:

AMRunningMode Normal

AntivirusEnabled True

RealTimeProtectionEnabled True

BehaviorMonitorEnabled True

IsTamperProtected True

Different results can be legitimate on a company-managed computer using third-party endpoint protection or Microsoft Defender for Endpoint. Do not change security modes on a managed device without involving IT.

Check Two: Review Protection History

Open:

Windows Security > Virus & threat protection > Protection history

Protection History shows actions Microsoft Defender has taken, potentially unwanted applications it has removed and important security services that have been switched off. Microsoft currently retains these entries for around two weeks, so review them promptly. (Microsoft Support⁠)

Look for:

Detected malware
Threats that were allowed instead of removed
Failed remediation
Items still awaiting action
Potentially unwanted applications
Real-time protection being disabled
Controlled Folder Access events
Repeated detection of the same file
Threats returning after restart

Expand each entry and note:

Detection name
File path
Date and time
Affected user
Action taken
Whether remediation succeeded

Do not automatically select Allow on device simply because a file is familiar. Attackers can place malicious files inside normal-looking application and user folders.

Check for Unknown Exclusions

Open:

Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions

Review the list.

Legitimate business software may require carefully controlled exclusions, but broad or unexplained exclusions can weaken protection.

Examples that deserve investigation include exclusions covering:

C:\

C:\Users

C:\Windows

C:\ProgramData

Also investigate exclusions for unfamiliar temporary folders, script directories or executable files.

Do not remove a company-approved exclusion without checking with IT, but make sure somebody can explain why each entry exists.

Check Three: Update Defender and Run the Right Scans

Update Microsoft Defender’s security intelligence before scanning.

You can do this through Windows Security or from an administrator PowerShell window:

Update-MpSignature

Microsoft’s Defender PowerShell module also supports starting scans and reviewing detected threats. (Microsoft Learn⁠)

Run a Quick Scan

A Quick scan checks common locations used by malware and is a useful initial test.

Open:

Windows Security > Virus & threat protection > Quick scan

A clean Quick scan is reassuring, but it is not a complete investigation.

Run a Full Scan

When the warning signs are more serious, select:

Scan options > Full scan

A Full scan examines available files and running programs more broadly. It may take a considerable amount of time on a computer containing several drives or large quantities of data.

From PowerShell, you can start one with:

Start-MpScan -ScanType FullScan

Run Microsoft Defender Offline

When you suspect persistent malware, a rootkit or a threat that returns after removal, select:

Scan options > Microsoft Defender Offline scan

The computer will restart and perform the scan outside the normal Windows session, making it harder for persistent malware to hide or defend itself. Microsoft describes Defender Offline as the most complete built-in Defender scanning option. (Microsoft Support⁠)

Save your work before starting it.

After Windows restarts, review the results under Protection History.

Review Detected Threats with PowerShell

You can also run:

Get-MpThreatDetection

This can provide additional information about threats Defender has detected and remediated. (Microsoft Learn⁠)

Do not assume that a detection classified as remediated closes the incident. A credential-stealing infection may have already captured passwords before it was removed.

Check Four: Look for Unknown Applications

Open:

Settings > Apps > Installed apps

Sort the list by installation date and review applications installed around the time the problem began.

Investigate:

Remote-access tools
Browser assistants
Search applications
Cryptocurrency miners
Driver-updater utilities
Unknown security programs
Unfamiliar VPN software
File-sharing tools
Screen-recording software
Applications with no recognisable publisher

Remote-support software is not automatically malicious. Products used legitimately by IT teams can also be abused by scammers or attackers.

Check whether the installation was:

Approved by the user
Installed by Hamilton Group or another authorised IT provider
Deployed through company management
Part of known business software
Installed during a suspicious support telephone call

Do not launch unfamiliar software merely to see what it does.

Check Five: Review Startup Applications

Malware and unwanted software often attempt to run automatically after Windows starts.

Open:

Settings > Apps > Startup

You can also open Task Manager and select Startup apps.

Windows allows registered startup applications to be reviewed through either Settings or Task Manager, with Task Manager providing extra information such as startup impact. (Microsoft Support⁠)

Look for entries with:

An unfamiliar name
No publisher
A suspicious file location
A recent installation date
An unnecessary remote-access function
A random sequence of letters
A path inside a temporary or Downloads folder

Do not assume every unnamed entry is malware. Some legitimate utilities are poorly labelled.

Right-click an entry in Task Manager and use Open file location where available. Software running from normal vendor directories may be legitimate, while software starting from an unusual temporary folder deserves closer inspection.

Disabling a startup item can stop it launching automatically, but it does not remove it or prove that the system is safe.

Check Six: Review Windows User Accounts

Open:

Settings > Accounts > Other users

Check every listed account.

Microsoft allows local and Microsoft accounts to be configured as standard users or administrators through Windows account settings. (Microsoft Support⁠)

Investigate:

Accounts nobody recognises
A standard account unexpectedly promoted to administrator
Old employee accounts that remain active
Temporary support accounts that were never removed
Family or shared accounts with administrator rights
Accounts created around the date of the suspected incident

Administrators have extensive control over the computer. The number of administrator accounts should be limited to those genuinely required.

Do not remove an account before confirming whether it belongs to:

Your authorised IT provider
Device-management software
A manufacturer’s recovery process
A legitimate business application

If a suspicious administrator account exists, disconnect the computer and seek professional help. The attacker may have made other changes that are not visible from this page.

Check Seven: Inspect Browser Extensions and Notifications

A compromised or unwanted browser extension can:

Read website content
Redirect searches
Inject advertising
Change the home page
Monitor browsing activity
Capture data entered into web pages
Display convincing fake security warnings

Open the extensions page in each installed browser and remove anything that cannot be explained.

Also check:

Default search engine
Home page
Startup pages
Site notification permissions
Saved passwords
Download history
Proxy settings
Browser-managed status

Browser notification permissions are frequently mistaken for malware. A website given permission to send notifications can display fake antivirus warnings even when the website is no longer open.

Do not telephone numbers shown in browser-based security warnings. Genuine Microsoft Defender alerts do not normally instruct you to call a random support number.

Check Eight: Review Microsoft Account Sign-In Activity

A clean computer scan does not rule out a compromised online account.

From another trusted device, review the Recent activity page for your personal Microsoft account.

Microsoft’s Recent activity page shows when and where the account has been used during the previous 30 days, including successful and unsuccessful sign-ins and the method used to access the account. (Microsoft Support⁠)

Look for:

Successful sign-ins you do not recognise
Unfamiliar countries or regions
New devices
Security-information changes
Password resets you did not request
New application permissions
Repeated unsuccessful attempts followed by a successful sign-in

Location information is not always precise. Mobile networks, corporate connections and VPNs may make a legitimate sign-in appear to come from another region.

Concentrate on combinations of location, time, device and sign-in method.

If Microsoft flags unusual activity, review it and secure the account immediately. (Microsoft Support⁠)

Check Nine: Review Work or School Sign-Ins

For a Microsoft 365 work or school account, review the My Sign-ins page from a trusted device.

Microsoft allows users to examine recent work or school account sign-ins and expand each item to check whether they recognise it. (Microsoft Support⁠)

Look for:

Sign-ins when you were not working
Devices you do not recognise
Unexpected legacy authentication
Repeated MFA failures
Authentication from unusual networks
Successful access after a suspicious MFA prompt

Do not approve an MFA request just to make repeated notifications stop. Attackers sometimes rely on users eventually approving one of many prompts.

When compromise is suspected:

Inform your IT provider.
Change the password from a trusted device.
Revoke existing sessions.
Review registered MFA methods.
Remove unknown authentication methods.
Check connected applications.
Review mailbox activity and forwarding.

The NCSC recommends changing compromised account passwords, logging out other devices and reviewing the affected account’s security. (National Cyber Security Centre⁠)

Check Ten: Inspect Outlook Rules and Forwarding

Email compromise may continue even after a password has been changed.

Attackers commonly create inbox or forwarding rules designed to:

Forward messages to an external address
Delete security alerts
Hide replies from customers or suppliers
Move financial messages into obscure folders
Monitor payment conversations
Redirect invoices
Conceal password-reset messages

Check Outlook and Outlook on the web for:

Inbox rules
Automatic forwarding
Delegated mailbox permissions
Unknown connected applications
Unexpected automatic replies
Messages in Sent Items you did not send
Deleted security notifications

Microsoft recommends reviewing inbox rules, hidden rules, forwarding settings, registered MFA devices, administrator changes and audit information when responding to a compromised Microsoft 365 account. (Microsoft Learn⁠)

For businesses, the visible Outlook rule list is not enough. Microsoft Purview audit logs can show who created, changed or deleted mailbox rules, while mailbox-access records can help determine whether email contents were accessed. (Microsoft Learn⁠)

Hamilton Group can carry out this deeper Microsoft 365 investigation rather than relying solely on what the user can see in Outlook.

Check Eleven: Look for Ransomware and Data Damage

Signs of ransomware can include:

Documents that no longer open
Files renamed with a new extension
Ransom notes in several folders
Desktop wallpaper replaced with payment instructions
Backup or shadow-copy errors
Security tools disabled
Large numbers of files changing rapidly
Network shares becoming inaccessible
Unusual outbound network activity
Threats to publish stolen data

Immediately disconnect affected devices and do not connect backup drives. NCSC and CISA guidance both prioritise containment and the protection of backups during ransomware incidents. (CISA⁠)

Do not rename encrypted files or run random decryptors downloaded from search results.

Keep copies of:

The ransom note
A small sample of encrypted files
The new file extension
Detection names
Screenshots
Relevant email messages
The approximate time the incident began

This information may help identify the ransomware family and determine whether a legitimate recovery method exists.

Check Twelve: Investigate Unexpected Network Activity

Open Task Manager and review network use under Processes.

For more detail, search Windows for:

Resource Monitor

Open the Network tab and review applications currently sending or receiving data.

Unexpected traffic can be suspicious, but many legitimate processes communicate in the background, including:

Windows Update
OneDrive
Teams
Browsers
Security software
Cloud backup tools
Application updaters

Do not block or terminate a process solely because it has network activity.

A proper assessment may require:

Endpoint detection logs
DNS history
Firewall records
Router logs
Microsoft 365 audit data
Known indicators of compromise
File hashes
Process trees
Authentication records

CISA’s incident-response guidance describes searching for indicators of compromise across collected evidence rather than relying on a single endpoint symptom. (CISA⁠)

This is one of the areas where an experienced cybersecurity team adds substantial value.

A Clean Antivirus Scan Does Not Prove the PC Was Never Compromised

A scan can show that the antivirus did not find known active malware at that moment.

It cannot automatically prove that:

Malware was never present.
Passwords were not stolen.
An attacker did not use legitimate remote-access tools.
Files were not copied.
A cloud account was not accessed.
The attacker did not remove their tools.
A mailbox rule was not created.
Another computer on the network is not compromised.
A new persistence method was not missed.
The system can safely be trusted for sensitive work.

Attackers increasingly make use of legitimate Windows tools, stolen credentials and remote-management applications. These activities may leave little or no conventional malware for an antivirus engine to detect.

Determining whether a computer has genuinely been compromised requires correlation across endpoint, identity, email, network and cloud evidence.

What Not to Do

Do Not Install Several Antivirus Products

Running several real-time antivirus engines can cause conflicts and does not guarantee a more accurate result.

Use one properly configured primary antivirus product.

Do Not Use Random “Malware Removal” Utilities

Unknown cleaning tools can introduce unwanted software, remove legitimate files or destroy evidence.

Use Microsoft tools and reputable security products obtained from their official sources.

Do Not Delete Everything Suspicious Immediately

Record the file path, detection name, time and associated process first.

On a business computer, preserve evidence where possible.

Do Not Change Passwords on a Suspected Compromised PC

A keylogger or remote attacker may capture the new password.

Use a separate, trusted device.

Do Not Reconnect Backups During an Active Incident

Ransomware may encrypt or delete connected backup data.

Do Not Assume a Factory Reset Fixes Every Part of the Incident

Resetting the computer may remove local malware, but it does not automatically:

Secure compromised accounts
Remove malicious email rules
Revoke stolen sessions
Repair other infected computers
Establish what data was stolen
Identify the original attack route

When Rebuilding Windows Is the Safest Option

Sometimes removing detected files is not enough.

A clean Windows installation or professionally controlled rebuild may be the safest response when:

A backdoor or remote-access Trojan was present.
An attacker gained administrator or SYSTEM-level access.
Security tools were disabled or modified.
Several persistence mechanisms are found.
The computer handled sensitive business or financial information.
The origin and scope of the attack cannot be established.
Malware repeatedly returns.
System files or security services cannot be trusted.
Ransomware affected the device.
A rootkit is suspected.
The device is subject to contractual or regulatory requirements.

Before rebuilding, make sure you have:

A verified backup of essential data
BitLocker recovery information
Application licence details
A list of required business software
Clean Windows installation media
Securely reset account credentials
A plan for validating restored files

Do not copy entire application-data and profile folders back onto the clean system without checking them. This can restore unwanted scripts, extensions or compromised settings.

How Hamilton Group Can Help

Checking whether a Windows 11 computer has been compromised requires more than running a quick antivirus scan.

Hamilton Group’s experienced IT and cybersecurity professionals can investigate the full incident, including the computer, user identities, Microsoft 365 environment, email configuration and wider business network.

Our team can help with:

Rapid Containment

We can help isolate affected devices and accounts quickly, reducing the risk of malware or an attacker spreading further.

Hamilton Group aims to make first contact on IT support requests within 15 minutes, helping businesses get experienced guidance at the point it matters most.

Endpoint Investigation

We can review:

Antivirus detections
Defender configuration
Security exclusions
Startup and persistence mechanisms
Installed applications
Remote-access software
User accounts and administrators
Windows event information
Suspicious processes and network activity
Evidence of ransomware or credential theft

Microsoft 365 and Identity Investigation

A compromise rarely stops at the laptop.

Hamilton Group can investigate:

Microsoft Entra sign-ins
Suspicious MFA activity
Mailbox forwarding
Inbox and hidden rules
Mailbox delegates
Administrator changes
Connected applications
Audit-log activity
OneDrive and SharePoint access
Compromised Teams and email accounts

Malware Removal and Secure Recovery

Where the system can be cleaned safely, we can remove the threat and restore the correct security configuration.

Where the computer can no longer be trusted, we can plan and perform a controlled rebuild, preserve important data and ensure that compromised settings are not simply copied back.

Password and Session Recovery

We can help reset affected credentials from a trusted environment, revoke active sessions, review MFA methods and remove unauthorised account access.

Root-Cause Analysis

Removing malware without addressing the original route of entry leaves the business exposed to a repeat incident.

Hamilton Group can investigate whether the incident began through:

Phishing
Stolen passwords
Weak or missing MFA
Unpatched software
Remote-access tools
Exposed services
Malicious attachments
Browser extensions
Administrator misuse
A compromised supplier
Another infected device

Long-Term Security Improvements

After recovery, our experienced team can strengthen the environment using:

Microsoft Defender for Business
Microsoft Defender for Endpoint
Microsoft Intune
Microsoft Entra ID security controls
Multifactor authentication
Conditional Access
Endpoint detection and response
Managed patching
Application control
Reliable backup and disaster recovery
Security monitoring
Staff security awareness

Our goal is not simply to make the warning disappear. We help establish what happened, protect the business and reduce the likelihood and impact of another incident.

A Practical Compromise Checklist

When you suspect a Windows 11 computer has been compromised:

Record the symptoms and when they started.
Disconnect the computer if an attack may be active.
Do not connect backup drives.
Contact IT from a separate trusted device.
Check the active antivirus provider.
Review Microsoft Defender Protection History.
Inspect Defender exclusions and protection settings.
Update security intelligence.
Run Quick, Full and Offline scans as appropriate.
Review recently installed software.
Check startup applications.
Review Windows user and administrator accounts.
Inspect browser extensions and notification permissions.
Review personal and work-account sign-ins.
Check Microsoft 365 mailbox rules and forwarding.
Look for ransomware or unusual file changes.
Change compromised passwords from a trusted device.
Revoke active sessions and review MFA methods.
Preserve evidence before deleting or rebuilding.
Investigate the original route of entry.
Check other users, devices and cloud services.
Rebuild Windows when the integrity of the system cannot be trusted.
Test backups before restoring data.
Strengthen security controls after recovery.

Get an Experienced Cybersecurity Assessment

If you suspect a Windows 11 computer has been compromised, acting quickly matters—but so does acting correctly.

Hamilton Group’s experienced team can help determine whether you are dealing with malware, a stolen account, an email compromise, ransomware or an ordinary Windows fault. We can contain the problem, investigate the evidence, recover affected systems and strengthen your security afterwards.

Call 0330 043 0069, book a meeting with one of our experts or visit hgmssp.com for experienced, practical support from Hamilton Group.