How to Fix Windows Defender Not Working on Windows 10 and 11
Windows Defender disabled, real-time protection grayed out, or virus definitions refusing to update? This guide covers every common Defender failure — third-party antivirus conflicts, Group Policy blocks, corrupted components, and malware actively disabling your protection — with step-by-step fixes.
- ✓Detects third-party antivirus conflicts and Group Policy settings that silently disable Defender
- ✓Repairs corrupted Windows Security Center services and restarts protection automatically
- ✓Identifies malware that has actively disabled Defender and restores real-time protection
Best for Defender disabled, real-time protection grayed out, virus definitions not updating, and "Threat service has stopped" errors on Windows 10 and 11.
Main Troubleshooting Guide
How to Fix Slow Computer →Complete symptoms, causes, and step-by-step solutions
Symptoms
You might be experiencing this problem if you notice:
- •Windows Security shows "Threat service has stopped"
- •Virus definitions won't update
- •Real-time protection grayed out and won't turn on
- •Windows Defender icon missing from taskbar
- •Quick scan finds nothing but PC is clearly infected
- •"Your IT administrator has limited access" message
Common types of Windows Defender failures
Third-Party Antivirus Conflict
Installing another antivirus (McAfee, Norton, Avast, Kaspersky) disables Defender automatically. If the other antivirus is partially uninstalled or corrupted, Defender stays disabled even though nothing is actively protecting the PC.
Group Policy / Registry Block
A Group Policy setting or registry key is preventing Defender from running. Common on corporate machines, but also happens on personal PCs due to leftover policies from removed antivirus software or malware that modified the registry.
Corrupted Defender Components
Windows Security Center, the Defender service, or the definition update mechanism is corrupted. Usually fixable with sfc /scannow, DISM repair, and PowerShell re-registration of Defender components.
Malware Disabling Defender
Active malware has modified Defender settings, disabled services, or tampered with the registry to prevent detection. Requires Safe Mode scanning and manual service restoration.
What RescuePC checks when Windows Defender stops working
Windows Defender can fail for at least five different reasons — a conflicting antivirus, a Group Policy block, a stopped service, corrupted components, or malware that actively disabled it. RescuePC checks each layer so you don't have to guess which one is broken.
- →Detects third-party antivirus software that silently disables Defender (McAfee, Norton, Avast, etc.)
- →Checks Group Policy and registry settings that block real-time protection or virus definition updates
- →Verifies Windows Security Center, Defender Antivirus Service, and all dependency services are running
- →Scans for corrupted Defender components and repairs them using DISM and component store recovery
- →Identifies malware that has tampered with Defender settings or disabled protection at the registry level
Most useful when Defender was working before and suddenly stopped, when real-time protection is grayed out, or when virus definitions refuse to update despite an active internet connection.
Manual troubleshooting vs RescuePC
On your own
- •Checking services.msc for multiple Defender-related services and their dependency chains
- •Manually editing Group Policy (gpedit.msc) or registry entries to re-enable Defender
- •Searching for and removing leftover antivirus components using vendor-specific removal tools
- •Running sfc /scannow and DISM commands to repair corrupted Defender components
- •Updating virus definitions manually via PowerShell when automatic updates fail
With RescuePC
- →Checks all Defender services, Group Policy settings, and registry values in one automated pass
- →Detects third-party antivirus remnants that are silently blocking Defender
- →Repairs corrupted Windows components that prevent Defender from initializing
- →Identifies whether the problem is a service failure, policy block, or active malware interference
Defender failures are hard to diagnose because the symptoms overlap — "grayed out" could mean a policy block, a conflicting antivirus, a stopped service, or malware. RescuePC checks all four causes instead of guessing.
When this page is most likely to help
- ✓Windows Defender was working before and recently stopped — nothing was intentionally changed
- ✓Real-time protection shows as grayed out or won't toggle on
- ✓Windows Security displays "Threat service has stopped" or similar service errors
- ✓Virus definitions are stuck and won't update despite having internet access
- ✓You uninstalled a third-party antivirus but Defender didn't re-enable itself
- ✓You see "Your IT administrator has limited access" on a personal (non-corporate) PC
Most Defender failures are caused by conflicting antivirus remnants, stopped services, or Group Policy blocks — all of which are fixable without reinstalling Windows.
When Defender repair may not be enough
Some Defender issues are outside the scope of software repair on your device.
- ⚠Your PC is managed by an organization (Intune, SCCM, Active Directory) that enforces Defender policies — you'll need your IT admin to change the policy
- ⚠You intentionally use a different antivirus and want to keep it — Defender is designed to stay disabled when another antivirus is active
- ⚠The PC is severely infected with rootkit-level malware that survives Safe Mode scans — may require offline scanning with a bootable rescue disk
- ⚠Windows itself is too corrupted for DISM and SFC to repair — a repair install (in-place upgrade) or clean install may be needed
- ⚠You're running a version of Windows that doesn't include Defender (e.g., Windows 7 or certain LTSC editions with limited security features)
Common Causes
- ⚠Third-party antivirus conflicting with Defender
- ⚠Group Policy or registry disabling Defender
- ⚠Windows Security Center service stopped
- ⚠Corrupted Windows Defender components
- ⚠Malware actively disabling Defender
- ⚠Windows Update failing to deliver definition updates
Solutions
Solution 1: Restart Windows Security Services
- 1Press Windows + R, type services.msc
- 2Find "Windows Security Service" and ensure it's running
- 3Find "Security Center" service and set to Automatic
- 4Find "Windows Defender Antivirus Service" and Start it
- 5Restart your computer and check Windows Security
Solution 2: Remove Conflicting Antivirus Software
- 1Go to Settings > Apps > Installed apps
- 2Look for third-party antivirus (McAfee, Norton, Avast, etc.)
- 3Uninstall it completely using its official removal tool
- 4Restart your computer
- 5Windows Defender should automatically re-enable
Solution 3: Reset Windows Defender via PowerShell
- 1Right-click Start > Windows Terminal (Admin)
- 2Run: Set-MpPreference -DisableRealtimeMonitoring $false
- 3Run: Update-MpSignature
- 4Run: Start-MpScan -ScanType QuickScan
- 5Check Windows Security to verify protection is active
Restore Windows Defender — the exact commands
Defender goes down for three reasons: another antivirus registered itself, its services were disabled, or its platform files corrupted. Check status first.
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdatedThe authoritative Defender status: whether the engine and real-time protection are running and how stale the signatures are.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdateForces a signature update — repairs a Defender that shows "out of date" and will not update from the UI.
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1Runs a quick scan from the command line — proves the engine actually works end-to-end.
sfc /scannowRepairs corrupted Defender platform files.
DISM /Online /Cleanup-Image /RestoreHealthRepairs the component store when Defender platform corruption persists.
If a third-party antivirus is installed, Defender disables itself BY DESIGN — uninstall the other product and Defender re-arms on reboot. RescuePC checks the status fields and repairs the service chain automatically.
Which Defender problem are you experiencing?
Real-time protection is grayed out and won't turn on
Likely cause: A third-party antivirus is installed (even partially), or Group Policy is blocking Defender. Uninstall competing antivirus completely using the vendor's removal tool, then check gpedit.msc > Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
"Threat service has stopped" error in Windows Security
Likely cause: The Windows Defender Antivirus Service (WinDefend) crashed or was stopped. Open services.msc, find "Windows Defender Antivirus Service," set it to Automatic, and start it. If it fails to start, run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth.
Virus definitions won't update — stuck on old definitions
Likely cause: Windows Update components are broken, or the definition download is being blocked. Run "Update-MpSignature" in PowerShell (Admin). If that fails, reset Windows Update components and check your internet connection and proxy settings.
"Your IT administrator has limited access" message
Likely cause: Group Policy or a management tool (Intune, SCCM) is enforcing settings that restrict Defender. On personal PCs, this usually means leftover registry entries from a previous antivirus or a malware infection that modified policy settings.
Defender scans run but find nothing despite obvious infection
Likely cause: Real-time protection may be on but definitions are outdated, or malware is actively evading Defender. Update definitions manually, then run a full scan (not quick). If still nothing, boot into Safe Mode and scan — some malware hides from normal-mode scans.
Best next step
Good fit for Defender disabled, real-time protection grayed out, "Threat service has stopped" errors, virus definitions not updating, and Defender not re-enabling after antivirus removal on Windows 10 and 11.
Why RescuePC handles Defender problems well
Windows Defender failures are frustrating because the Windows Security app gives you almost no diagnostic information — just a grayed-out toggle or a vague service error. The actual cause could be a policy block, a conflicting antivirus, a corrupted component, or malware — and they all look the same.
- →Checks all Defender service dependencies, Group Policy settings, and registry values in one pass
- →Detects third-party antivirus remnants that silently prevent Defender from re-enabling
- →Repairs corrupted Windows Security Center and Defender components using targeted DISM recovery
- →Identifies malware interference patterns that have tampered with Defender's ability to protect the PC