Windows Security’s Action recommended warning usually means Microsoft Defender or another protection area needs attention.
This guide explains how to fix Windows Security action recommended with clear steps that address the most common causes without unnecessary risk.
What does Windows Security Action recommended mean?
The Windows Security app aggregates protection status for antivirus, firewall, account protection, device security, app and browser control, and more.
When one of these areas is disabled, outdated, misconfigured, or reporting a problem, Windows displays Action recommended instead of a fully protected status.
In many cases, the warning is not a serious failure.
It may appear after a policy change, a Windows update, a third-party antivirus installation, or a temporarily disconnected security service.
The key is identifying which protection area is triggering the alert.
Common reasons the warning appears
- Microsoft Defender Antivirus is turned off or has outdated signatures.
- Real-time protection is disabled by policy or another security app.
- Firewall and network protection is not active on one or more network profiles.
- SmartScreen, tamper protection, or app and browser control requires attention.
- Windows Security service or related background services are not running correctly.
- A third-party antivirus is installed and has taken over protection tasks.
- Security status data is stale because of a corrupted Windows Security app or a pending update.
How to fix Windows Security action recommended
1. Open Windows Security and check the flagged area
Start in the Windows Security dashboard and look for the section marked with a warning icon.
The alert itself often names the issue, such as virus protection, firewall, device security, or account protection.
- Open Start and search for Windows Security.
- Select the app and review the dashboard.
- Open any area marked Action recommended.
- Follow the prompt to turn on, update, or review settings.
This step matters because the fix depends on the exact component that is failing.
2. Update Microsoft Defender antivirus definitions
Outdated threat definitions can trigger warnings even when protection is otherwise enabled.
Updating Defender is one of the fastest ways to clear false or temporary alerts.
- Open Windows Security.
- Go to Virus & threat protection.
- Select Protection updates.
- Choose Check for updates.
If you prefer using settings, run Windows Update as well, because platform and security intelligence updates are sometimes delivered together.
3. Turn on real-time protection if it is off
Real-time protection is a core Defender feature.
If it has been disabled, Windows will often show Action recommended until it is restored.
- Open Windows Security.
- Select Virus & threat protection.
- Under Virus & threat protection settings, choose Manage settings.
- Enable Real-time protection.
If the switch is greyed out, another antivirus app or an organization policy may be controlling that setting.
4. Check whether a third-party antivirus is installed
Security suites from vendors such as Norton, McAfee, Bitdefender, Kaspersky, Trend Micro, and others can disable Microsoft Defender components or place them in passive mode.
This is normal, but incomplete removal or conflicting protection tools can leave Windows reporting an alert.
- Open Settings and review installed apps.
- Uninstall unused or duplicate antivirus software.
- Restart the PC after removal.
- Reopen Windows Security and verify the status.
If you want to use Microsoft Defender as the primary antivirus, ensure no other active antivirus engine is installed.
5. Restart the Windows Security service
Background services support Windows Security notifications and status reporting.
If one service stalls, the dashboard may show outdated information.
- Press Win + R, type services.msc, and press Enter.
- Locate Security Center and Windows Security Service, if present.
- Right-click each service and choose Restart.
- If a service is stopped, set it to Automatic or the default startup type recommended by Windows.
After restarting, refresh the Windows Security app and check whether the warning disappears.
6. Run Windows Update
Security alerts may persist when Windows itself is missing critical updates.
Microsoft frequently releases fixes for Defender, the Security app, and system components that report protection status.
- Open Settings.
- Select Windows Update.
- Click Check for updates.
- Install all available updates and restart if prompted.
If the system has pending cumulative updates, let them finish before rechecking Windows Security.
7. Repair or reset the Windows Security app
If the app cache or configuration is corrupted, the status page may keep showing an incorrect warning.
Windows 11 and Windows 10 both allow app repair and reset options through Settings.
- Open Settings and go to Apps.
- Select Installed apps or Apps & features.
- Find Windows Security.
- Open Advanced options.
- Try Repair first, then Reset if needed.
Repair preserves data where possible.
Reset clears local app data and is more effective when the warning is caused by a broken interface state.
8. Verify firewall and network protection
Windows Defender Firewall is a major part of the Action recommended status.
If one network profile is off, the system may continue showing a warning.
- Open Windows Security.
- Go to Firewall & network protection.
- Check Domain network, Private network, and Public network.
- Turn the firewall on for any profile that is disabled.
On managed devices, a business policy may control firewall behavior.
In that case, contact the administrator instead of forcing changes locally.
9. Enable tamper protection
Tamper protection helps prevent unauthorized changes to key Defender settings.
If it is off, the security posture may appear incomplete.
- Open Windows Security.
- Go to Virus & threat protection.
- Select Manage settings.
- Turn on Tamper Protection.
This feature is especially important on personal PCs exposed to common malware tactics that try to disable antivirus protection.
10. Use the built-in troubleshooter for security and updates
Windows includes troubleshooters that can fix issues with update components, network configuration, and related services.
These tools do not solve every case, but they are useful when the alert appears after a system change.
- Open Settings.
- Go to System > Troubleshoot > Other troubleshooters.
- Run any relevant troubleshooters for Windows Update, Network Adapter, or Internet Connections.
When the warning returns after you fix it
If Windows Security action recommended keeps coming back, the issue may be deeper than a simple toggle.
Repeated alerts can point to corrupted system files, a strict enterprise policy, or a security product that is partially installed.
Useful next checks include:
- Running SFC /scannow and DISM to repair system files.
- Reviewing Group Policy or Intune settings on managed PCs.
- Removing leftover files from old antivirus suites.
- Scanning for malware with an offline or second-opinion scanner.
On work devices, some options may be controlled by IT and cannot be changed locally.
If Defender settings are locked, the warning may be intentional rather than a fault.
Best practices to prevent future alerts
- Keep Windows Update enabled and install patches promptly.
- Use only one primary antivirus solution at a time.
- Leave real-time protection and tamper protection on unless you have a specific reason to disable them.
- Check Windows Security after major feature updates or antivirus changes.
- Restart the computer after removing security software so Windows can refresh status data.
By checking the flagged area first, then updating Defender, confirming services, and verifying firewall and app settings, you can usually fix Windows Security action recommended without advanced tools.
If the message persists, the cause is often a policy conflict, a partial antivirus installation, or a Windows component that needs repair.
}