If Microsoft Defender is not working, the cause is usually a disabled service, a conflicting antivirus, corrupted security components, or a policy setting blocking protection.
This guide explains how to fix Microsoft Defender not working with clear checks that cover Windows 10 and Windows 11.
Why Microsoft Defender stops working
Microsoft Defender Antivirus is built into the Windows Security platform, but it depends on several connected components: Windows Update, the Security Center service, real-time protection settings, and system files.
If any one of these is damaged or switched off, Defender may appear unavailable, inactive, or unable to scan.
Common symptoms include missing virus protection status, gray or disabled toggles in Windows Security, scan errors, or messages that another antivirus is managing protection.
In managed devices, Group Policy or Microsoft Intune can also override local settings.
Check whether another antivirus is installed
Defender often turns off when a third-party antivirus such as Norton, McAfee, Bitdefender, Avast, or Kaspersky is installed.
Windows is designed to let one primary real-time antivirus control active protection.
- Open Settings and go to Apps or Installed apps.
- Look for any third-party security suite.
- Uninstall it if you want Microsoft Defender to take over.
- Restart the PC after removal.
Some antivirus products leave background drivers or cleanup tools behind, so check the vendor’s official removal utility if Defender still does not activate.
Confirm Microsoft Defender is enabled in Windows Security
Sometimes Defender is not broken; it is simply disabled in the interface.
Windows Security is the control center for antivirus and threat protection settings.
- Open Windows Security.
- Select Virus & threat protection.
- Choose Manage settings.
- Turn on Real-time protection, Cloud-delivered protection, and Automatic sample submission.
If the toggles are unavailable, the issue is usually deeper than a simple setting and may involve permissions, policy restrictions, or service failures.
Restart the core Windows security services
Microsoft Defender depends on several services, especially the Security Center and Windows Security Health services.
If they stop, the app can report stale status or fail to enforce protection.
To check services:
- Press Win + R, type services.msc, and press Enter.
- Find Security Center, Microsoft Defender Antivirus Service, and Windows Security Service if present.
- Make sure their startup type is not disabled.
- Restart each service if the option is available.
If a service repeatedly stops, note the error and move on to system repair, because the underlying cause is often a damaged Windows component or policy conflict.
Run Windows Update and restart
Defender definitions and security platform fixes are delivered through Windows Update.
Outdated builds can break Defender user interface elements, scan engines, or threat intelligence updates.
- Open Settings and go to Windows Update.
- Install all quality and security updates.
- Restart the system, even if Windows does not request it.
- Check for updates again after rebooting.
This step is especially important after major feature updates, since Defender components may need a refreshed platform package to function normally.
Repair corrupted system files
If Windows security files are corrupted, Defender may fail to launch or update definitions.
Use built-in repair tools before reinstalling anything.
Run System File Checker
Open Command Prompt as administrator and run:
sfc /scannow
This scans protected Windows files and replaces damaged copies from the local cache.
Run DISM if SFC does not fix it
In an elevated Command Prompt, run:
DISM /Online /Cleanup-Image /RestoreHealth
DISM repairs the Windows image that SFC relies on.
After it completes, run sfc /scannow again and restart the computer.
Check Group Policy settings on Pro and Enterprise editions
On Windows Pro, Enterprise, or Education, Group Policy can disable Microsoft Defender completely.
This is common on work devices or after hardening tools modify the system.
Open the Local Group Policy Editor and inspect these locations:
- Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
- Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
Look for policies such as Turn off Microsoft Defender Antivirus.
If enabled, set it to Not Configured or Disabled, then refresh policy and restart.
Look for registry changes that disable Defender
Some optimization scripts, privacy tools, and malware change registry values that suppress Defender.
This is common when third-party tweak utilities are used.
Areas to review include the Defender policy branch under HKEY_LOCAL_MACHINE.
If you are not comfortable editing the registry, use Group Policy, a trusted security tool, or official Microsoft repair methods instead.
Incorrect registry edits can break Windows security further.
Scan for malware or unwanted software
Ironically, malware is one of the reasons Microsoft Defender stops working.
Some threats disable security services, block updates, or tamper with Windows Security.
- Run an offline or full scan if Defender is partially working.
- Use Microsoft Defender Offline scan from Windows Security when available.
- Check for browser hijackers, ransomware tools, or unwanted remote-access software.
If the PC is heavily compromised, booting into safe mode or using recovery tools may be necessary before Defender can be restored.
Reset the Windows Security app
The Windows Security interface itself can become corrupted even when the antivirus engine is still present.
Resetting the app can restore missing pages or broken toggles.
Go to Settings > Apps > Installed apps, find Windows Security, open Advanced options, and select Repair.
If that does not help, choose Reset.
Then reopen Windows Security and check the protection status again.
Use PowerShell to refresh Defender components
PowerShell can help when the Defender app is installed but not responding correctly.
Administrative commands can reset preferences or update signatures.
Useful checks include:
- Get-MpComputerStatus to view Defender status
- Update-MpSignature to refresh definitions
- Set-MpPreference for advanced policy-related settings
If the command output shows that the antivirus engine is inactive, use that information to narrow the issue to services, policy, or platform corruption.
When to reset or repair Windows
If you have tried updates, service checks, scans, and repair tools but Microsoft Defender still does not work, Windows itself may be the problem.
A repair install preserves apps and files while replacing damaged operating system components.
Consider a repair install when:
- Defender and Windows Security both fail after every restart.
- SFC and DISM report errors they cannot fix.
- Group Policy and third-party antivirus are not the cause.
- The device shows multiple unrelated Windows errors.
A clean installation is usually the last resort, but it often restores Defender when system corruption is extensive.
What to check after Microsoft Defender starts working
Once Defender is restored, confirm that the basics are healthy:
- Virus & threat protection status shows active protection.
- Security intelligence updates download successfully.
- Real-time protection stays on after reboot.
- Scheduled and manual scans complete without errors.
- No warning icons remain in Windows Security.
Keeping Windows Update current, avoiding duplicate antivirus tools, and not using aggressive registry cleaners helps prevent the problem from returning.