.webp)
Quite the pain when Windows Security (formerly Windows Defender) keeps blocking, quarantining, or deleting your KMS Pico file, isn’t it? Don’t worry. It’s 100% preventable. This guide will teach you how to fix this major issue so you can activate Windows or Office peacefully.
Before we get started:
- Make sure that you have access to a reputed KMS Pico download that is updated.
- You cannot activate Windows Vista and Microsoft Office 365 subscriptions.
- Ensure there is no other antivirus or anti-malware software on your PC. Check your Control Panel!
Now, let’s get right into how to fix this issue.
Step 1: Exclusion
First, we need to exclude two directories. We will take the example of Windows 11, but the steps are similar in Windows 7, 8, 8.1, and 10 as well.
- Go to C:/Program Files and create a folder called KMS Pico. Remove any previous installation or file.
- Open Windows Security.
- Go to Virus & Threat Protection.
- Under the heading “Virus & threat protection settings,” click on Manage Settings.
- Scroll all the way down to find Exclusions. Click on “Add or remove exclusions.”
- Here, click on the “Add an exclusion” button and choose “Folder.”
- This will open File Explorer.
- Choose the Downloads directory (assuming this is where your downloads happen from the browser automatically).
- Repeat Step 7 and choose the folder we created in Step 1.
Now, both folders are excluded—where KMS Pico will be downloaded and where it will be installed.
Step 2: Turn Off Protections
The above steps will be sufficient in most cases, but we want to be safe, just in case. So, we will turn off all protections in Windows Defender. Specifically, turn these off:
- Virus and threat protection > Manage Settings > Real-time protection (toggle off)
- App & browser control > Reputation-based protection > Reputation based protection settings > Phishing protection (toggle off)
- App & browser control > Reputation-based protection > Reputation based protection settings > Potentially unwanted app blocking (toggle off)
These are the three core protections that can interfere with KMS Pico.
Step 3: Retry Installation!
Now, it is time to retry the KMS Pico download and installation process. Follow these steps:
- Close all apps except the browser.
- Go to a reputed website and download KMS Pico in the excluded Downloads folder.
- Extract the zip file and open the extracted folder.
- (Optional) Turn off ethernet or WiFi.
- Right-click on the executable and select Run as Administrator.
- Follow the on-screen instructions and launch KMS Pico.
- Installation steps will be shown, select the intended functions (activate Windows or Office).
- Wait for the process to finish.
Voila! Now, you have successfully activated your Windows or Office without Windows Defender interfering at all!
Step 4: Final Steps
Go to your settings to check the activation status of your Windows installation.
- Windows 11: Open Settings > System > Activation
- Windows 10: Open Settings > Update & Security > Activation
Here, you can confirm that Windows is indeed activated.
If you activated Office, you can check that by opening any Microsoft Office product, opening the menu, and going to “Account.”
Now, it’s time to take the final steps:
- Turn the Windows Defender protections back on.
- If you have not downloaded an auto-renewing KMS tool (AutoKMS), then you can safely uninstall the tool from the Control Panel.
- Make an additional exclusion in your Drive and save your downloaded KMS Pico folder inside it to protect it for future use, if KMS activation gets stripped away by a Windows update.
You can keep the excluded folders there.
Why Does Windows Defender Block/Quarantine/Delete KMS Pico?
Windows Defender (now called Windows Security) blocks, quarantines, or deletes KMS Pico because it identifies the tool as potentially harmful. While this can be frustrating, the reason lies in how KMS Pico operates and the methods it uses to activate software.
- File Modification Behavior: KMS Pico modifies system files to emulate Microsoft’s Key Management Service (KMS) protocol. This behavior is flagged by antivirus programs because modifying protected files is a technique often associated with malicious software. Windows Defender, in particular, is designed to be vigilant about such activities, labeling them as threats even if the tool itself is safe.
- Heuristic-Based Detection: Antivirus software like Windows Defender uses heuristic analysis to detect potential threats. Instead of matching files against a known virus database, it evaluates a program’s behavior. KMS Pico’s actions—creating a local KMS server, altering activation files, and bypassing Microsoft licensing—trigger heuristic alarms. Even though these activities are intended for activation, they closely resemble the behavior of malware.
- Potentially Unwanted Program (PUP) Classification: KMS Pico is often classified as a Potentially Unwanted Program (PUP). This classification doesn’t mean the tool is inherently malicious, but rather that it performs actions not approved by the software vendor (in this case, Microsoft). As an unlicensed activation tool, KMS Pico falls into this grey area, leading Windows Defender to treat it as suspicious.
- Risk of Modified Versions: Another reason Windows Defender is aggressive toward KMS Pico is the prevalence of tampered or fake versions. Many unofficial sources offer modified versions of the tool, which may include malware, spyware, or adware. Windows Defender cannot distinguish between a safe version of KMS Pico and a harmful one, so it flags all versions to err on the side of caution.
- Protection of Microsoft’s Licensing System: At its core, Windows Defender is designed to protect Microsoft’s software integrity and licensing model. KMS Pico bypasses this system to activate products without a license key, violating Microsoft’s terms of service. Defender is programmed to detect and remove any tools that undermine this system, ensuring compliance and preventing unauthorized use.
Windows Defender’s aggressive stance on KMS Pico stems from its core security principles. While the tool is widely used and effective, it operates in a manner that antivirus software deems risky. But don’t worry—just follow the steps we have outlined in this guide and you should be good to go!
Though the majority of reasons are simply false alarms, there is one real risk—the risk of downloading an infected version. This happens all the time. Bad actors know that people download KMS from the internet without doing much research. As such, they have their own versions laced with malware, spyware, adware, etc. As KMS Pico can keep running until uninstalled, these malicious programs can compromise the security of your PC. Always download from reputed and vetted sources!