How to Fix Windows Security Virus Protection Off
If Windows Security says virus protection is off, Microsoft Defender may not be actively protecting your PC.
This guide explains the most common causes and the fastest ways to turn protection back on without guesswork.
Windows 11 and Windows 10 rely on Microsoft Defender Antivirus for real-time protection, cloud-delivered protection, and tamper protection.
When any of those components stop working, the Windows Security app may show warnings that can be confusing, but the fix is usually straightforward.
Why Windows Security Shows Virus Protection Off
The warning can appear for several reasons, and not all of them mean your PC is infected.
Understanding the cause helps you choose the right fix and avoid unnecessary changes.
- Another antivirus is installed: Third-party security software often disables Microsoft Defender to prevent conflicts.
- Services are stopped: Core Windows services such as Security Center or Microsoft Defender Antivirus may not be running.
- Policy settings changed: Group Policy or registry settings may have disabled Defender features.
- Windows is missing updates: Outdated security definitions or system updates can break protection status reporting.
- Corrupted system files: Damage to Windows components can stop Windows Security from reading protection correctly.
- Tamper Protection or permissions issues: Security settings may have been altered by software, malware, or administrative restrictions.
Check Whether a Third-Party Antivirus Is Installed
The first thing to verify is whether another antivirus product is active.
Products from Norton, McAfee, Bitdefender, Kaspersky, ESET, Avast, and others can take over antivirus protection and cause Microsoft Defender to appear off.
- Open Settings.
- Go to Apps and review installed security software.
- If you find a third-party antivirus, open it and check whether it is disabled, expired, or partially uninstalled.
- Uninstall the product if you no longer want it, then restart the PC.
After restart, open Windows Security and check whether Virus & threat protection is active.
If the third-party product is still installed and working, Defender may remain in passive mode, which is normal.
Restart the Security Center and Defender Services
Windows Security depends on background services to report status correctly.
If those services stop, the app may show virus protection as off even when the system is otherwise healthy.
- Press Windows + R, type services.msc, and press Enter.
- Find Security Center.
- Make sure its startup type is set to Automatic and the service is running.
- Find Microsoft Defender Antivirus Service or related Defender entries.
- Start any stopped service and restart the PC.
If you prefer a command-line approach, open Windows Terminal as administrator and run a service check with administrative privileges.
This can help when the Services console does not resolve the problem.
Turn Microsoft Defender Back On in Windows Security
If Defender is available but disabled, you may be able to re-enable it directly in Windows Security.
This is common after removing another antivirus product.
- Open Windows Security.
- Select Virus & threat protection.
- Open Manage settings.
- Turn on Real-time protection.
- Enable Cloud-delivered protection and Automatic sample submission if they are off.
If the toggles are unavailable or instantly switch back off, a policy, service, or administrative restriction is likely blocking the change.
Update Windows and Security Intelligence
Outdated malware definitions or missing OS updates can interfere with Defender’s status.
Keeping Windows current is one of the most reliable ways to restore accurate protection reporting.
- Open Settings and go to Windows Update.
- Install all available updates.
- Restart if prompted.
- Open Windows Security and check for security intelligence updates.
Security intelligence updates are the threat definition files Microsoft Defender uses to detect malware, ransomware, and phishing-related threats.
A current update can fix both protection and status issues.
Run the Windows Defender Antivirus Troubleshooter?
Windows does not always include a dedicated Defender troubleshooter, but built-in repair tools can still help.
When the problem is tied to system corruption or a bad update, repair tools often restore the security stack.
Use these tools in order:
- Windows Update Troubleshooter: Helps if a failed update is causing the issue.
- System File Checker: Repairs corrupted system files with the sfc /scannow command.
- Deployment Image Servicing and Management: Use DISM /Online /Cleanup-Image /RestoreHealth to repair the Windows image.
Run Command Prompt or Windows Terminal as administrator before using SFC or DISM.
After the repairs finish, restart and recheck Windows Security.
Check Group Policy and Registry Settings
On some PCs, Defender is disabled by policy rather than by a normal app setting.
This often happens on managed work computers, but it can also occur after third-party tweaks or cleanup tools change system settings.
In Group Policy Editor, look for Windows Defender Antivirus policies that disable real-time protection or turn off Defender.
In the registry, verify that settings related to Defender have not been set to disable the service or interface.
- Managed devices: Contact your IT administrator before changing policies.
- Home devices: Revert suspicious policy changes only if you know they were applied locally.
- Be careful: Incorrect registry edits can make the problem worse.
If you are not comfortable editing policy or registry settings, continue with safer repair steps first.
Make Sure Tamper Protection Is Enabled
Tamper Protection helps prevent malware and other software from changing important Defender settings.
If it is off, or if malware has modified security settings, Windows Security may show abnormal protection status.
- Open Windows Security.
- Go to Virus & threat protection.
- Select Manage settings.
- Turn on Tamper Protection if it is available.
On some systems, Tamper Protection may be controlled by an organization or by another security product.
If the switch is unavailable, the device may be managed by policy.
Perform an Offline or Full Malware Scan
If the warning appeared after suspicious behavior, run a scan before making deeper changes.
Malware can disable antivirus features, block service startup, or hide behind fake security prompts.
- Quick scan: Checks common malware locations quickly.
- Full scan: Reviews more files and takes longer.
- Microsoft Defender Offline scan: Restarts the computer and scans before Windows fully loads, which helps detect stubborn threats.
Open Windows Security, choose Scan options, and pick the scan type that matches your situation.
If malware is found, quarantine or remove it and restart the device.
When to Reset or Repair Windows Security
If the app still says virus protection is off after updates, scans, and service checks, the Windows Security app itself may be damaged.
Repairing or resetting the app can restore proper status display.
- Open Settings and go to Apps.
- Find Windows Security in the app list.
- Select Advanced options.
- Choose Repair first.
- If needed, select Reset after repair.
Repair keeps app data where possible, while reset may restore the app to its default state.
Use reset only after simpler fixes fail.
Signs the Problem Is More Than a Display Issue
Sometimes Windows Security shows a warning because the protection status is genuinely compromised.
Pay attention if you notice any of these signs:
- Real-time protection cannot be enabled at all.
- Threat detections stop appearing after a scan.
- The device repeatedly disables Defender after reboot.
- Security settings change without your action.
- Unexpected pop-ups, browser redirects, or unknown startup items appear.
Those symptoms may indicate malware, a failed uninstall, or deeper Windows corruption.
In that case, use offline scanning and system repair before assuming the issue is harmless.
Prevent Windows Security From Turning Off Again
Once protection is restored, a few habits can reduce the chance of the warning returning.
These steps are especially useful on home PCs that regularly install and remove software.
- Keep Windows Update enabled and install security patches promptly.
- Avoid running multiple antivirus tools at the same time.
- Use reputable software sources and avoid bundled installers.
- Check Defender status after removing another antivirus product.
- Keep Tamper Protection on whenever possible.
Regular updates, clean uninstall practices, and fewer security conflicts help Windows Security remain stable and accurate.