Microsoft senior engineer Raymond Chen detailed a support case on October 8, highlighting the risks of running multiple antivirus programs on Windows 11. The conflict arises when two security tools attempt to monitor and intercept the same system functions simultaneously.
In the described scenario, two security applications, referred to as Contoso and Fabrikam, triggered a deadlock. Fabrikam invoked a function that Contoso had already intercepted, leading Contoso to flag Fabrikam as a threat and attempt to isolate its process. Simultaneously, Fabrikam intercepted a function used by Contoso, causing the latter to trigger its own isolation mechanism.
Chen compared this interaction to two security firms patrolling the same building without coordination, where each treats the other as an intruder. Antivirus software often relies on unofficial methods, such as hooking system functions, which can alter the intended behavior of system calls and lead to application crashes.
The engineer noted that diagnosing these conflicts is difficult, as there is no straightforward way to determine if a system failure stems from interference between security tools. Even when a conflict is identified, it is often impossible to restrict the operational scope of each individual security program to prevent further overlap.
