How to Fix Windows Defender Not Working or Turned Off

•
Ankit Kumar
Windows 11SecurityFixTroubleshooting

The Problem

Windows Security warns that virus protection is off, or the Real-time protection toggle snaps back to disabled after you switch it on. Sometimes a removed antivirus left drivers behind. Sometimes malware turned Defender off deliberately.

Treat the second possibility seriously. Disabling Defender is one of the first things most malware families do. If protection switched itself off with no explanation, assume the machine may be compromised and follow the scan steps at the end.

Active infection suspected? Once Defender runs again, go through remove a virus or malware for a full offline scan.

Symptoms

  • Yellow banner: Virus & threat protection is turned off.
  • The Turn on button greyed out, or protection off again after every restart.
  • This app has been turned off and isn't monitoring your PC in Security Center.
  • Windows Security opens to a blank page, or will not open at all.

Step 1: Remove Conflicting Antivirus

Defender stands down automatically when another antivirus registers itself—and a partially uninstalled one leaves the registration behind while providing no protection at all. That is the worst of both worlds and it is extremely common.

  1. Settings → Apps → Installed apps → uninstall any Norton, McAfee, Avast, AVG, Kaspersky, or Bitdefender.
  2. Then run the vendor's dedicated removal tool—every major vendor publishes one, and a normal uninstall routinely leaves filter drivers behind.
  3. Restart before testing Defender again.

Check what Windows thinks is registered: Windows Security → Virus & threat protection → Manage providers.

Step 2: Turn It On, With Tamper Protection

  1. Settings → Privacy & security → Windows Security → Virus & threat protection.
  2. Manage settings → turn on Real-time protection.
  3. Turn on Tamper Protection in the same panel. This is the important one: it prevents software and scripts from switching Defender off again, and it must be enabled from the UI—it cannot be set by policy or registry from outside.
  4. Also enable Cloud-delivered protection and Automatic sample submission.

Step 3: Start the Services

  1. Win + R → services.msc.
  2. Confirm these are running with the correct startup type:
    • Microsoft Defender Antivirus Service (WinDefend) — Automatic
    • Microsoft Defender Antivirus Network Inspection Service — Manual
    • Windows Security Service (SecurityHealthService) — Automatic
    • Security Center (wscsvc) — Automatic (Delayed Start)
  3. Start anything stopped, then restart the PC.

If WinDefend refuses to start, a policy or registry key is blocking it—Step 4.

Step 4: Check for Policy Blocks

Windows 11 Pro, Enterprise, Education

  1. Win + R → gpedit.msc.
  2. Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus.
  3. Set Turn off Microsoft Defender Antivirus to Not Configured.
  4. Check the Real-time Protection subfolder for Turn off real-time protection and set that to Not Configured too.
  5. Run gpupdate /force and restart.

Windows 11 Home — Registry

Before editing the registry: create a restore point first — create a system restore point.

Check HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender for a DisableAntiSpyware value set to 1 and delete it, then restart.

If Tamper Protection is on, Windows blocks this edit—which is the feature working correctly. Turn Tamper Protection off temporarily, make the change, then turn it back on.

Note: these keys being set on a home PC that no administrator configured is a strong indicator of malware or a "debloat" script. Treat it accordingly.

Step 5: Repair the Security App

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage

Then reopen Windows Security from Start. If the app was corrupt, the interface returns.

You can also reset the Defender platform itself from Terminal (Admin):

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Step 6: Repair System Files

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Then install all pending Windows updates—Defender's platform updates arrive through Windows Update, and a stalled update pipeline leaves it stale. See Windows Update stuck.

Step 7: Scan Properly Once It Works

Do not stop at "the warning went away."

  1. Virus & threat protection → Scan options → Full scan.
  2. Then run Microsoft Defender Antivirus (offline scan). It restarts the PC and scans before Windows loads, which catches the rootkits and persistent malware that disabled Defender in the first place.
  3. Check what is set to run at startup: remove malware startup entries and scheduled tasks.

Still Off After All This?

  • S Mode, or a school or work MDM enrolment, can lock antivirus settings—check Settings → Accounts → Access work or school, and speak to the administrator.
  • Corrupted install: an in-place repair keeps your files and applications — reinstall Windows without losing data.

Once Defender Is Healthy

Turn on the protections that are off by default:

And if Defender was switched off without your doing it, treat the PC as compromised: change your passwords from a different device, and review what to do after a remote access scam if anyone had remote control of it.

Related guides