Set up antivirus on a new PC correctly, and you close most of the security gaps a brand-new machine actually has — which, contrary to the assumption that “new means safe,” usually starts with OEM trialware, an out-of-date Windows install, and antivirus settings left at their defaults. Microsoft itself published a support document on April 9, 2026 stating that “Windows 11 is the most secure Windows yet, and it already includes a complete antivirus stack (Windows Defender) that runs by default” — but that baseline only holds if you actually configure it correctly. This is the order that avoids the most common new-PC security mistakes.
Table of Contents
Step 1: Remove OEM Trialware First
Most new PCs from Dell, HP, Lenovo, ASUS, and other major manufacturers ship with a preinstalled trial security suite — McAfee and Norton are the most common — bundled because manufacturers negotiate commercial arrangements with security vendors to offset hardware costs.
This preinstalled suite duplicates Windows Security’s own functionality, nags for a paid upgrade almost immediately after first boot, and can consume real system resources running a full trial security engine you never actively chose to install. If you don’t intend to pay for and keep that specific product, remove it with its official removal tool before doing anything else, following the same vendor-specific process covered in our antivirus uninstall guide. Removing it first, before you install anything else, avoids the exact conflicts that guide describes. This is a core part of how you set up antivirus on a new PC correctly from the very start.
Step 2: Decide — Keep Defender or Install Third-Party
With the trialware gone, you’re on a clean baseline: Windows Defender, Microsoft’s built-in antivirus. In AV-Comparatives’ March 2026 Malware Protection Test, Defender scored 18/18 with Advanced+ certification and a 99.89% online protection rate — a genuinely strong, independently verified result. Whether that’s enough on its own or you should add a third-party product depends on your situation; see our full Windows Defender vs third-party antivirus comparison for the detailed breakdown (offline detection, browser coverage, bundled features) before deciding. Make this decision before continuing, since the rest of the setup order depends on it. Getting this right matters because it’s exactly what it means to set up antivirus on a new PC properly.
Step 3: Update Windows Before Anything Else Security-Related
Go to Settings → Windows Update and install every available update, including optional driver updates, before configuring any antivirus settings. Both Defender’s own detection engine and any third-party product you might choose instead depend on current Windows Update patches for the underlying operating-system vulnerabilities they’re designed to work alongside, not in place of — an antivirus can catch malware, but it can’t retroactively patch an unpatched OS-level exploit the malware used to get in. Expect at least one restart during this step; run Windows Update again afterward, since a new PC is often several update cycles behind the version it left the factory with. Skipping this step undermines the rest of the process to set up antivirus on a new PC safely.
Step 4: Configure Windows Defender Properly
If you’re keeping Defender as your primary antivirus, its defaults are reasonable but not complete. Open Windows Security → Virus & threat protection and check each of these: This detail is central to how you set up antivirus on a new PC without leaving gaps.
Enable Tamper Protection
Under Virus & threat protection settings, confirm Tamper Protection is on. It prevents malware (or a malicious script) from disabling Defender’s real-time protection through the registry or Group Policy — a real attack technique some malware families use specifically to disable security software before deploying their actual payload. This is a core part of how you set up antivirus on a new PC correctly from the very start.
Turn On Controlled Folder Access
Under Ransomware protection, enable Controlled Folder Access and confirm your Documents, Pictures, and Desktop folders are all listed as covered. It’s off by default specifically because it can prompt for legitimate apps the first time they write to a protected folder, but that one-time friction is worth the added ransomware barrier for most users. Getting this right matters because it’s exactly what it means to set up antivirus on a new PC properly.
Confirm Cloud-Delivered Protection Is On
This is what gives Defender its fast response to brand-new threats, since it checks suspicious files against Microsoft’s live threat intelligence rather than waiting for a local signature update. It’s on by default, but worth explicitly verifying on a fresh install rather than assuming, along with “Automatic sample submission,” which helps Microsoft’s detection engine improve its response to brand-new threats for every Defender user, not just you. Skipping this step undermines the rest of the process to set up antivirus on a new PC safely.
Step 5: If Installing Third-Party — Do It in This Order
If you’ve decided a paid suite is the better fit (see Step 2), install it only after Windows is fully updated, and only after confirming any OEM trialware is completely removed — not just disabled. Windows Defender will automatically step back into passive mode on its own once it detects the new product successfully registering itself with Windows Security Center, so you don’t need to manually disable or configure Defender first before installing anything new.
During setup, create your account with the vendor and register the license key before closing the installer, and let the product download its latest virus definitions before running the first scan — a scan run against day-one virus definitions is measurably less useful than the same scan run after the first definitions update has actually completed in the background. This detail is central to how you set up antivirus on a new PC without leaving gaps.
Step 6: Run a Full Scan, Then Schedule Weekly Scans
Whichever product you’re running, kick off one full system scan (not just a quick scan) once it’s installed and updated — this establishes a clean baseline and catches anything that might have been present before the antivirus was fully active. After that first scan, schedule recurring full scans for a time you genuinely won’t be using the PC, such as overnight, since a full system scan does use noticeable CPU and disk resources for its entire duration while it runs. This is a core part of how you set up antivirus on a new PC correctly from the very start.
Step 7: Enable Browser-Level Protection
Antivirus software is built primarily to protect files and running processes, but a meaningful share of real-world attacks actually start with a malicious link delivered by email or a search result, not a malicious file sitting on the drive. If you’re using Edge, Microsoft SmartScreen is already active by default. If you’re using Chrome or Firefox, install your antivirus vendor’s browser extension (most major suites offer one) or, at minimum, enable each browser’s own built-in “Enhanced Safe Browsing” or phishing-protection setting in its security settings menu — see our phishing prevention guide for the full picture. Getting this right matters because it’s exactly what it means to set up antivirus on a new PC properly.
Antivirus Isn’t Your Only Layer — Two More Built-In Protections
Enable Device Encryption or BitLocker
On most modern Windows 11 PCs, Device Encryption is already on by default once you sign in with a Microsoft account, but it’s worth confirming under Settings → Privacy & security → Device encryption. On Pro editions, full BitLocker offers more granular control. This protects your files if the physical machine is ever lost or stolen, since the data on the drive stays unreadable without the correct account credentials or recovery key — a scenario antivirus software, which protects against malicious code rather than physical device theft, doesn’t address at all. Skipping this step undermines the rest of the process to set up antivirus on a new PC safely.
Turn On File History or OneDrive Backup
Antivirus software and Controlled Folder Access both meaningfully reduce the odds of a successful ransomware attack, but neither one, alone or combined, guarantees zero risk against every possible technique an attacker might use. Enabling File History (Settings → System → Backup) or OneDrive’s folder backup gives you a real, independent recovery path for your Documents, Pictures, and Desktop folders if something does get through — a second layer that doesn’t depend on the antivirus catching everything. This detail is central to how you set up antivirus on a new PC without leaving gaps.
Setting Up Across Multiple Devices or for Family Members
Most paid antivirus suites sell multi-device licenses (typically 3, 5, or 10 devices under one subscription) rather than per-machine pricing, which matters if you’re setting up more than one new PC at once or adding a phone and tablet to the same plan.
Register the license under one central account during setup so every device reports into a single dashboard, rather than creating a separate account for each individual device you set up — most vendors’ web consoles let you see protection status across every registered device from one screen, which is genuinely useful the first time a device shows a problem you’d otherwise have to notice locally. This is a core part of how you set up antivirus on a new PC correctly from the very start.
If you’re setting a PC up for a child or a family member rather than yourself, it’s worth configuring parental controls or content filtering at the same time as antivirus, rather than as a separate later step — see our guide to parental controls in antivirus software for how that fits into the same setup process. Getting this right matters because it’s exactly what it means to set up antivirus on a new PC properly.
Common New-PC Setup Mistakes
- Installing a new antivirus before removing OEM trialware. This is the single most common cause of a brand-new PC having two antivirus products silently conflicting from day one.
- Skipping Windows Update because “it’s a new PC.” Factory images are frequently months out of date by the time a PC actually reaches a buyer.
- Never running the first full scan. Real-time protection only catches new threats going forward — it doesn’t retroactively check what was already on the drive before it activated.
- Leaving Controlled Folder Access off indefinitely because the first setup prompt was mildly inconvenient, rather than allowlisting the specific app once and moving on.
Does a new PC need antivirus if I only use it for browsing and email?
Yes — browsing and email are actually two of the most common infection vectors, through malicious downloads and phishing links, so “light use” doesn’t reduce the need for baseline protection. Windows Defender’s default configuration covers this reasonably well once the setup steps above are complete. Skipping this step undermines the rest of the process to set up antivirus on a new PC safely.
How long does the first full antivirus scan take on a new PC?
It varies with drive size and speed, but a full scan on a new PC’s drive (which typically has far fewer files than a machine that’s been in use for years) usually completes faster than the same scan would later, once the drive fills up with documents, photos, and installed applications — it’s a good reason to run that first full scan early, while it’s still quick. This detail is central to how you set up antivirus on a new PC without leaving gaps.
Frequently Asked Questions
Do I need to buy antivirus for a new PC?
Not necessarily. Windows Defender is included at no cost and scored 18/18 with Advanced+ certification in AV-Comparatives’ March 2026 testing. Whether to add a paid product depends on specific gaps (offline detection, bundled VPN/password manager) covered in our Defender comparison guide, not a requirement to purchase something on day one. This is a core part of how you set up antivirus on a new PC correctly from the very start.
Should I remove the McAfee or Norton trial that came with my new PC?
If you don’t intend to pay for and keep that specific product past its trial period, yes — remove it with the vendor’s official removal tool rather than letting it expire on its own, since an expired trial can leave real-time protection disabled while still occupying system resources and Security Center registration. Getting this right matters because it’s exactly what it means to set up antivirus on a new PC properly.
What’s the very first thing I should do on a new PC, before antivirus?
Connect to the internet and run Windows Update fully, including a second pass after the first restart. Antivirus configuration matters, but it works best on a fully patched OS, and a factory-fresh PC is rarely on the latest build. Skipping this step undermines the rest of the process to set up antivirus on a new PC safely.
Is it safe to skip the first full antivirus scan and just rely on real-time protection?
Not ideal — real-time protection only evaluates files as they’re accessed or created going forward. A full scan checks everything already present on the drive, including anything that arrived with the factory image or an initial software transfer, which real-time protection alone won’t retroactively catch. This detail is central to how you set up antivirus on a new PC without leaving gaps.
How to Verify Your Setup Actually Worked
Before considering the PC done, run through this short verification pass rather than assuming everything took effect: This is a core part of how you set up antivirus on a new PC correctly from the very start.
- Open Windows Security → Virus & threat protection and confirm exactly one product shows as active — either Defender or your chosen third-party product, not both, and not neither.
- Check that virus definitions show a recent update date, not the date the product was first installed — a stale definitions date usually means automatic updates aren’t actually running in the background the way the settings claim they should be.
- Confirm the first full scan actually completed and reported a clean or actionable result, rather than being left running indefinitely in the background or silently failing partway through without you noticing.
- Reopen Windows Update one more time and confirm no updates remain pending or queued — a PC that still shows pending updates after the setup process hasn’t finished this checklist yet.
To recap: the safest way to set up antivirus on a new PC is trialware removal, then Windows Update, then configuration, in that exact order.