If Windows Security stopped working after you removed a third-party antivirus, the cause is usually a disabled Defender service, corrupted security settings, or leftover vendor drivers.
This guide shows how to fix Windows Security after antivirus uninstall and restore Microsoft Defender without guesswork.
Why Windows Security Can Break After Uninstalling Antivirus
Third-party antivirus programs often disable Microsoft Defender Antivirus while they are installed.
Some also add firewall rules, security center services, or kernel drivers that remain active after removal, which can prevent Windows Security from re-enabling itself normally.
In Windows 10 and Windows 11, Windows Security depends on several components working together, including Microsoft Defender Antivirus, Windows Security Center, the Firewall service, and real-time protection.
If any one of these is misconfigured, the Security app may show warnings, refuse to open, or report that protection is managed by another provider.
Check Whether the Antivirus Was Fully Removed
The first step is to confirm that the old antivirus is actually gone.
Some vendors leave behind background services or cleanup tools that must be removed manually.
- Open Settings > Apps > Installed apps.
- Look for the previous antivirus, endpoint protection, or security suite.
- Uninstall anything that remains.
- Restart the PC after removal.
If the vendor provides an official removal utility, use it.
Products from companies such as Norton, McAfee, Avast, AVG, Bitdefender, Kaspersky, and ESET often have dedicated cleanup tools that remove drivers and registry entries more thoroughly than standard uninstallers.
Restart Windows Security Services
Windows Security depends on services that may be disabled during third-party antivirus installation.
Re-enabling them is one of the fastest ways to restore protection.
- Press Win + R, type services.msc, and press Enter.
- Find Security Center.
- Set Startup type to Automatic (Delayed Start).
- If the service is stopped, click Start.
- Also check Microsoft Defender Antivirus Service and Windows Security Service, if present.
After changing the service settings, restart the computer.
Security Center often needs a reboot to detect that Defender is available again.
Turn Microsoft Defender Back On
If another antivirus was recently removed, Microsoft Defender may still be disabled at the policy level or by a leftover setting.
Use the Windows Security app to verify that protection is active.
- Open Windows Security.
- Select Virus & threat protection.
- Open Manage settings.
- Turn on Real-time protection, Cloud-delivered protection, and Automatic sample submission.
If the toggles are missing or grayed out, the issue may be caused by a policy, registry value, or security suite residue that needs deeper repair.
Use the Malware Removal and Defender Recovery Tools
Microsoft includes tools that can repair or refresh security components.
Running them can help when Windows Security opens but fails to scan or update.
Run a Microsoft Defender scan
- Open Windows Security.
- Go to Virus & threat protection.
- Click Quick scan.
If Quick scan fails, try an offline scan.
Microsoft Defender Offline restarts the system and scans before Windows fully loads, which can help when malware or a leftover driver is interfering with security services.
Reset the Windows Security app
- Open Settings > Apps > Installed apps.
- Find Windows Security.
- Choose Advanced options.
- Click Repair, then Reset if needed.
This does not remove Defender, but it can fix a damaged app interface and restore missing controls.
Check Group Policy or Registry Blocks
In managed environments, antivirus removal may expose existing policies that still disable Defender.
On some PCs, these settings were added by a previous administrator or security suite.
On Windows Pro and Enterprise, open the Group Policy Editor and review policies related to Microsoft Defender Antivirus.
Look for settings that disable real-time protection or prevent Defender from starting.
On Home editions, similar restrictions may appear in the registry, often under Defender or Security Center policy keys.
Be careful when editing policy or registry values.
If you are not sure which setting was changed, create a restore point first or ask an IT administrator to verify the configuration.
Remove Leftover Security Software Drivers
Some antivirus programs install kernel-level drivers that continue to load after uninstall.
These drivers can block Defender, interfere with network inspection, or make Windows Security report that another provider is active.
Signs of leftover drivers include:
- Windows Security says protection is managed by an app.
- Defender scans start and stop immediately.
- The firewall or threat protection pages are blank.
- A vendor name still appears in Security Center.
Use the vendor’s cleanup utility if available.
If not, check Device Manager and Services for clearly branded security components, then remove them only if you know they belong to the old antivirus product.
Repair System Files if Windows Security Still Fails
Corrupted Windows components can stop Security Center, Defender, or the Settings app from loading properly.
If the problem persists after uninstall cleanup and service resets, repair system files.
Open Command Prompt as administrator and run:
- sfc /scannow
- DISM /Online /Cleanup-Image /RestoreHealth
Run SFC first, then DISM if necessary, and restart the computer afterward.
These commands repair Windows image corruption and replace damaged system files that Defender relies on.
Install the Latest Windows Updates
Security features often depend on current Windows components and malware definitions.
An outdated build can keep Windows Security from working correctly after antivirus removal.
- Open Settings > Windows Update.
- Check for updates.
- Install all available cumulative updates.
- Restart when prompted.
After updating Windows, return to Virus & threat protection and confirm that security definitions update successfully.
Defender should download the latest intelligence automatically once the system is healthy.
When to Use a Clean Boot or Safe Mode
If Windows Security works in Safe Mode but not in normal startup, another background program is likely interfering.
A clean boot helps identify conflicts caused by startup items, third-party firewall tools, or security-related utilities left behind by the old antivirus.
- Use msconfig to perform a clean boot.
- Disable non-Microsoft startup services.
- Restart and test Windows Security again.
This approach is especially useful if the uninstall left behind a network filter, parental control app, VPN client, or system hardening tool that still blocks Defender.
Common Fixes by Symptom
Different error messages point to different causes.
Matching the symptom to the fix can save time.
- Protection is managed by your organization: Check Group Policy, registry restrictions, or leftover enterprise antivirus settings.
- Windows Security won’t open: Reset the app, repair system files, and restart Security Center.
- Real-time protection won’t turn on: Remove leftover antivirus drivers and re-enable Defender services.
- No scan results or scan errors: Run SFC, DISM, and Microsoft Defender Offline.
- “Threat service has stopped”: Verify Defender services and install Windows updates.
How to Prevent the Problem Next Time
If you plan to replace one antivirus with another, uninstalling in the right order reduces the chance of a broken security state.
Before removing the current product, confirm whether the replacement tool is already downloaded and compatible with your Windows version.
- Use the vendor’s official uninstaller or cleanup utility.
- Restart immediately after removal.
- Install the new antivirus only after the old one is fully gone.
- Confirm that Windows Security or Microsoft Defender is active if no replacement is installed.
Keeping Windows updated, avoiding multiple security suites at once, and checking Defender status after every major software change will help prevent future conflicts.
If Windows Security still does not recover, the remaining issue is usually a driver, policy, or system file problem rather than Defender itself.