Windows Security Center was introduced in Windows XP Service Pack 2 (SP2) to improve the manageability and visibility of key security capabilities in personal computers. These capabilities include the following:

• Detecting whether a firewall is turned on.
• Detecting whether Automatic Updates is turned on.
• Detecting whether an antivirus application is turned on and is up to date.

Windows Vista added the following capabilities:

• Detecting whether an antispyware application is turned on and is up to date.
• Detecting whether User Account Control is turned on.
• Detecting whether the Internet settings are set to their recommended levels.

Q: What is Windows Security Center?

A: Windows Security Center lets you automatically verify the status of the major security functions: Firewall, Automatic Updates, Virus Protection, Spyware Protection, User Account Control, and Internet Settings. When a problem is detected, you receive notification and a list of recommended steps that may help secure your computer.

Q: When will I interact with, or see, Windows Security Center?

A: When all Windows Security Center components are in a secure and up–to-date state, no alerts appear. This condition is known as the "green" state. If any one of the components are in a nonsecure or undetectable state, a red icon that is shaped like a shield appears in the icon tray and a balloon message states that "Your computer might be at risk." This condition is known as the "red" state.

Q: How does Windows Security Center detect third-party products and their status?

A: In Windows XP SP2 and in later versions, Windows Security Center uses a two-tiered approach for detection status. One tier is manual, and the other tier is automatic through Windows Management Instrumentation (WMI). In manual detection mode, Windows Security Center searches for registry keys and files that are provided to Microsoft by independent software manufacturers. These registry keys and files let Windows Security Center detect the status of independent software. In WMI mode, software manufacturers determine their own product status and report that status back to Windows Security Center through a WMI provider. In both modes, Windows Security Center tries to determine whether the following is true:

• An antivirus program is present.
• The antivirus signatures are up to date.
• Real-time scanning or on-access scanning is turned on for antivirus programs.
• For firewalls, Windows Security Center detects whether a third-party firewall is installed and whether the firewall is turned on or not.

In Windows Vista, Windows Security center no longer uses the manual detection mode. All third-party products report their states into WMI. In addition, in Windows Vista Windows Security Center also determines whether the following is true:

• An antispyware program is present.
• The antispyware signatures are up to date.

Q: What recommendations are made when my antivirus program is out-of-date or when I have no antivirus program installed?

A: When Windows Security Center does not detect an antivirus program, you receive the following message:



If you click the balloon, Windows Security Center opens in Control Panel.

In Windows XP SP2 and later versions, if you then click Recommendations, Windows Security Center displays a Recommendation dialog box. If you click How?, you are directed to a Web page that lists Microsoft Windows Security Center antivirus partners.

In Windows Vista, if you click Find a program, Windows Security Center opens a Web page that has links to compatible antivirus vendor pages. You can also click Show me my available options. If you click this, the following options appear:

• I have an antivirus program that I’ll monitor myself
• Don’t monitor my antivirus software (not recommended)

When Windows Security Center detects that an antivirus program is out-of-date, you receive the following message:



If you click the balloon, Windows Security Center opens in Control Panel.

In Windows XPSP2 or later versions, if you click Recommendations, the following two options appear:

• Update one of your installed antivirus programs. Note: You’ll have to make sure that you have a current subscription with your antivirus provider to do this.
• Get another antivirus program. How?

In Windows Vista, if the antivirus provider has supplied a way to update the signatures through Windows Security Center, you can click the Update now button. This opens the antivirus providers update mechanism.

You can also click Show me my available options. If you click this, the following options appear:

• Go online to get a different antivirus program
• I have an antivirus program that I’ll monitor myself
• Don’t monitor my antivirus software (not recommended)

Q: Are all the major antivirus manufacturers participating?

A: We have received cooperation from all the major antivirus manufacturers.

Q: Will I be forced to use certain third-party antivirus, antispyware, or firewall software? Can I use software that is not detected by Windows Security Center?

A: You are not required to use an antivirus, antispyware, or firewall software program that is compliant with Windows Security Center. If you use software that is not detectable, you may select Windows Security Center options that let you monitor your security status on your own. This scenario causes a “yellow” caution state, but you will not receive messages that prompt you to change your configuration.

Q: What happens if an antivirus, antispyware, or firewall software manufacturer decides not to participate?

A: Windows Security Center will try to tell you about antivirus, antispyware, or firewall programs that reside on your computer. If a manufacturer decides not to participate, Windows Security Center will not be able to detect the manufacturer's programs.

Q: Does Windows Security Center recognize third-party firewalls?

A: Yes. Windows Security Center will recognize third-party firewalls. Third-party firewall manufacturers work with Windows Security Center by using the same process as the antivirus software manufacturers.

Q: Do third-party firewall manufacturers have to do anything to be recognized by Windows Security Center?

A: Yes. For manual detection to occur, third-party firewall software must be compatible with Windows Security Center detection. However, any firewall software manufacturer can create a WMI provider and report program status directly to Windows Security Center.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.