How to Fix Real Time Protection Not Turning On
Microsoft Defender Real-time protection helps block malware before it can run, but sometimes the setting refuses to turn on.
This guide explains the most common causes and the exact Windows fixes that usually restore it.
What Real-Time Protection Does in Microsoft Defender
Real-time protection is a core Microsoft Defender Antivirus feature in Windows 10 and Windows 11.
It continuously scans files, downloads, scripts, and running processes to detect threats such as ransomware, trojans, spyware, and potentially unwanted applications.
When it will not turn on, the problem can be caused by policy restrictions, conflicting antivirus software, corrupted Windows security components, system services, or malware that has changed security settings.
In some cases, the toggle appears disabled because another management layer is controlling Defender.
Why Real-Time Protection May Not Turn On
- Third-party antivirus is installed: Another security suite can disable Microsoft Defender components.
- Group Policy or registry settings block it: Managed devices often enforce security rules.
- Windows Security app is corrupted: The interface may fail even when the engine works.
- Required services are stopped: Security Center or Defender services may not be running.
- Malware altered security settings: Some threats intentionally disable protection.
- System files are damaged: Windows component corruption can break Defender controls.
Check for Another Antivirus Program
The first step in learning how to fix real time protection not turning on is to confirm whether a third-party antivirus product is installed.
Products from vendors such as Norton, McAfee, Bitdefender, Avast, AVG, Kaspersky, and ESET can take over active protection and prevent Microsoft Defender from enabling its own real-time monitoring.
What to do
- Open Settings and go to Apps or Installed apps.
- Look for any antivirus, endpoint security, or internet security software.
- Uninstall the product if you no longer use it.
- Restart the PC and check Microsoft Defender again.
If you need to keep the third-party antivirus, use that vendor’s real-time protection instead of Microsoft Defender.
Restart the Windows Security and Defender Services
Defender depends on background services to enforce protection settings.
If these services are stopped, disabled, or stuck, the toggle may not respond correctly.
Services to check
- Microsoft Defender Antivirus Service
- Security Center
- Windows Security Service
Open Services from the Start menu, then verify that the services are running.
If a service is stopped, start it.
If it is set to Disabled, change the startup type to Manual or Automatic when available.
After that, restart Windows and test the setting again.
Make Sure Defender Is Not Managed by Policy
On work or school computers, Microsoft Intune, Group Policy, or other endpoint management tools may control Defender settings.
In that case, the real-time protection switch can appear locked or ignored because a policy is enforcing the current state.
On a personal PC, you can inspect local policy settings using the Group Policy Editor on supported editions of Windows.
Check these policy areas
- Computer Configuration
- Administrative Templates
- Windows Components
- Microsoft Defender Antivirus
Look for settings that disable Microsoft Defender Antivirus or real-time protection.
If a policy is enabled, set it to Not Configured unless the device is managed by your organization.
Some enterprise devices will require an administrator to change the policy centrally.
Re-enable Real-Time Protection from Windows Security
Sometimes the toggle is off because a temporary glitch prevented Defender from saving the change.
Open the Windows Security app and go to Virus & threat protection, then select Manage settings.
Try these steps
- Turn Real-time protection off, wait a few seconds, and turn it on again.
- Close Windows Security completely.
- Restart the PC and check whether the switch stays on.
- Run Check for updates in Windows Update, then try again.
Also review whether Tamper Protection is enabled.
This feature helps prevent unauthorized security changes, but if Defender settings were altered by other software, it may be useful to verify that tamper protection is active after the main issue is resolved.
Repair or Reset the Windows Security App
If the Windows Security interface is damaged, the Real-time protection toggle may not behave normally even when Defender services are fine.
Repairing the app often clears UI-level problems.
Repair options
- Open Settings > Apps > Installed apps.
- Find Windows Security.
- Open Advanced options.
- Use Repair first, then Reset if needed.
After a reset, Windows Security may restore default app data and refresh the interface.
Reopen the app and check whether the real-time protection toggle can be enabled.
Run System File Repair Tools
Windows system file corruption can interfere with Defender components.
Two built-in tools are especially useful: SFC and DISM.
Run these commands in an elevated Command Prompt
- sfc /scannow
- DISM /Online /Cleanup-Image /RestoreHealth
SFC checks protected system files and replaces damaged copies.
DISM repairs the Windows image itself, which can fix deeper component store issues.
After both commands finish, restart the computer and test real-time protection again.
Scan for Malware That May Be Blocking Defender
Malware can disable Microsoft Defender or make security settings appear broken.
If you suspect infection, use an offline scan or a trusted second-opinion scanner.
Recommended approach
- Run a Microsoft Defender Offline scan if available.
- Use a reputable rescue scanner from another security vendor.
- Disconnect from the internet if suspicious activity is ongoing.
- After cleanup, recheck Defender settings and Windows Security services.
Threats that modify security controls often require multiple scans and a restart before Defender returns to normal behavior.
Use PowerShell to Verify Defender Status
Advanced users can check whether Microsoft Defender is active through PowerShell.
This helps confirm whether the issue is only visual or whether protection is actually disabled.
Useful cmdlet
- Get-MpComputerStatus
This command displays Defender health data, including real-time protection status, antivirus status, and behavior monitoring information.
If the command shows protection is disabled while the UI suggests otherwise, the issue is deeper than a simple toggle problem.
When to Update Windows or Perform an In-Place Repair
If nothing else works, the problem may be tied to a broken Windows build or a bad update.
Installing the latest cumulative update can restore Defender compatibility and fix security app issues.
For persistent problems, an in-place repair install of Windows preserves files and apps while replacing core operating system components.
This is often the best option when Windows Security, Defender services, and system files all appear partially corrupted.
Quick Checklist for Fixing the Issue
- Remove or disable third-party antivirus software.
- Restart Defender-related services.
- Check Group Policy or device management settings.
- Repair or reset the Windows Security app.
- Run SFC and DISM repairs.
- Scan for malware using offline or second-opinion tools.
- Install the latest Windows updates.
If you are trying to understand how to fix real time protection not turning on, the most reliable path is to rule out software conflicts first, then repair Windows security components, and finally investigate deeper system corruption or malware interference.