# How to Fix Windows Defender Not Working or Turned Off

URL: https://www.mytechnician.tech/tips/fix-windows-defender-not-working/
Published: 2026-05-20 | Updated: 2026-08-10 | Author: Ankit Kumar
Tags: Windows 11, Security, Fix, Troubleshooting
Summary: Windows Security shows threats need attention but Defender won't turn on—fix group policy blocks, stale services, and malware that disables antivirus.
Recommended app: PC-Troubleshooter — https://www.mytechnician.tech/apps/windows-troubleshooter/ (Microsoft Store: https://apps.microsoft.com/detail/9N7RWKW8SP24?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
Windows Security warns that virus protection is off, or the **Real-time protection** toggle snaps back to disabled after you switch it on. Sometimes a removed antivirus left drivers behind. Sometimes malware turned Defender off deliberately.

**Treat the second possibility seriously.** Disabling Defender is one of the first things most malware families do. If protection switched itself off with no explanation, assume the machine may be compromised and follow the scan steps at the end.

> **Active infection suspected?** Once Defender runs again, go through [remove a virus or malware](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) for a full offline scan.

## Symptoms
* Yellow banner: **Virus & threat protection is turned off**.
* The **Turn on** button greyed out, or protection off again after every restart.
* **This app has been turned off and isn't monitoring your PC** in Security Center.
* Windows Security opens to a blank page, or will not open at all.

## Step 1: Remove Conflicting Antivirus
Defender stands down automatically when another antivirus registers itself—and a partially uninstalled one leaves the registration behind while providing no protection at all. That is the worst of both worlds and it is extremely common.

1. **Settings** → **Apps** → **Installed apps** → uninstall any Norton, McAfee, Avast, AVG, Kaspersky, or Bitdefender.
2. Then run the vendor's **dedicated removal tool**—every major vendor publishes one, and a normal uninstall routinely leaves filter drivers behind.
3. Restart before testing Defender again.

Check what Windows thinks is registered: **Windows Security** → **Virus & threat protection** → **Manage providers**.

## Step 2: Turn It On, With Tamper Protection
1. **Settings** → **Privacy & security** → **Windows Security** → **Virus & threat protection**.
2. **Manage settings** → turn on **Real-time protection**.
3. Turn on **Tamper Protection** in the same panel. This is the important one: it prevents software and scripts from switching Defender off again, and it must be enabled from the UI—it cannot be set by policy or registry from outside.
4. Also enable **Cloud-delivered protection** and **Automatic sample submission**.

## Step 3: Start the Services
1. `Win + R` → `services.msc`.
2. Confirm these are running with the correct startup type:
   * **Microsoft Defender Antivirus Service** (`WinDefend`) — Automatic
   * **Microsoft Defender Antivirus Network Inspection Service** — Manual
   * **Windows Security Service** (`SecurityHealthService`) — Automatic
   * **Security Center** (`wscsvc`) — Automatic (Delayed Start)
3. Start anything stopped, then restart the PC.

If `WinDefend` refuses to start, a policy or registry key is blocking it—Step 4.

## Step 4: Check for Policy Blocks
### Windows 11 Pro, Enterprise, Education
1. `Win + R` → `gpedit.msc`.
2. **Computer Configuration** → **Administrative Templates** → **Windows Components** → **Microsoft Defender Antivirus**.
3. Set **Turn off Microsoft Defender Antivirus** to **Not Configured**.
4. Check the **Real-time Protection** subfolder for **Turn off real-time protection** and set that to **Not Configured** too.
5. Run `gpupdate /force` and restart.

### Windows 11 Home — Registry
> **Before editing the registry:** create a restore point first — [create a system restore point](https://www.mytechnician.tech/tips/create-system-restore-point-windows-11/).

Check `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender` for a **DisableAntiSpyware** value set to `1` and delete it, then restart.

If Tamper Protection is on, Windows blocks this edit—which is the feature working correctly. Turn Tamper Protection off temporarily, make the change, then turn it back on.

**Note:** these keys being set on a home PC that no administrator configured is a strong indicator of malware or a "debloat" script. Treat it accordingly.

## Step 5: Repair the Security App
```powershell
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
```

Then reopen Windows Security from Start. If the app was corrupt, the interface returns.

You can also reset the Defender platform itself from **Terminal (Admin)**:

```cmd
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -removedefinitions -dynamicsignatures
```
```cmd
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate
```

## Step 6: Repair System Files
```cmd
DISM /Online /Cleanup-Image /RestoreHealth
```
```cmd
sfc /scannow
```

Then install all pending Windows updates—Defender's platform updates arrive through Windows Update, and a stalled update pipeline leaves it stale. See [Windows Update stuck](https://www.mytechnician.tech/tips/fix-windows-update-stuck-windows-11/).

## Step 7: Scan Properly Once It Works
Do not stop at "the warning went away."

1. **Virus & threat protection** → **Scan options** → **Full scan**.
2. Then run **Microsoft Defender Antivirus (offline scan)**. It restarts the PC and scans before Windows loads, which catches the rootkits and persistent malware that disabled Defender in the first place.
3. Check what is set to run at startup: [remove malware startup entries and scheduled tasks](https://www.mytechnician.tech/tips/remove-malicious-scheduled-tasks-startup-persistence-windows-11/).

## Still Off After All This?
* **S Mode**, or a school or work **MDM** enrolment, can lock antivirus settings—check **Settings** → **Accounts** → **Access work or school**, and speak to the administrator.
* Corrupted install: an in-place repair keeps your files and applications — [reinstall Windows without losing data](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/).

## Once Defender Is Healthy
Turn on the protections that are off by default:

* [Controlled Folder Access](https://www.mytechnician.tech/tips/enable-controlled-folder-access-ransomware-protection-windows-11/) — ransomware protection.
* [Smart App Control and SmartScreen](https://www.mytechnician.tech/tips/enable-smart-app-control-reputation-protection-windows-11/).
* [Core Isolation and Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/).

And if Defender was switched off without your doing it, treat the PC as compromised: change your passwords from a different device, and review [what to do after a remote access scam](https://www.mytechnician.tech/tips/what-to-do-after-remote-access-scam-anydesk-teamviewer/) if anyone had remote control of it.

---
Source: https://www.mytechnician.tech/tips/fix-windows-defender-not-working/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: PC-Troubleshooter (PC-Troubleshooter is a system diagnostic and repair tool for Windows 10 and Windows 11—hardware, drivers, network, and common fixes in one app.) — https://www.mytechnician.tech/apps/windows-troubleshooter/
More guides: https://www.mytechnician.tech/llms.txt