Can't turn on Microsoft Defender? How to fix it
Microsoft Defender turns itself off when another antivirus is installed. Fully remove that program, clear any blocking policy, and switch protection back on.
If Windows Security says Microsoft Defender is turned off and the switch won’t stay on, that usually isn’t a bug. Defender steps aside on purpose when another antivirus is installed, and it stays off until that program is completely gone. Uninstall the other antivirus, clear any leftover policy, confirm the Security Center service is running, and Defender comes back on almost every time. Here is how to work through it on Windows 11 and Windows 10.
Find what’s actually protecting the PC
Open the Windows Security app (search Windows Security from Start) and select Virus & threat protection. If you see another product’s name, or a line about using other antivirus providers, Defender has handed off protection rather than failed. To confirm which app is registered, go to Virus & threat protection > Who’s protecting me? > Manage providers and look under Antivirus.
On Windows 10 and Windows 11 without the enterprise Defender for Endpoint product, Microsoft Defender Antivirus turns itself off automatically when a non-Microsoft antivirus is installed. So the first question is never “why is Defender broken” but “what else is running?”
| What you see | Likely cause | Fix |
|---|---|---|
| Another antivirus is listed as your provider | A third-party AV is installed and registered | Uninstall it fully, then restart |
| Toggle turns on, then flips back off | Leftover files or an expired trial AV | Run the vendor’s removal tool |
| Real-time protection is grayed out or “managed” | A Group Policy or leftover registry policy | Set the policy to Not Configured |
| Windows Security won’t open or shows errors | The Security Center service is stopped | Restore its default startup and start it |
| The switch won’t change at all | Tamper Protection is guarding the setting | Turn Tamper Protection off first |
Uninstall any third-party antivirus completely
Defender will not resume while another real-time antivirus is registered, so remove it. On Windows 11 use Settings > Apps > Installed apps; on Windows 10 use Control Panel > Programs and Features. Uninstall the security product, then restart. Microsoft says Defender re-enables automatically once the other product is uninstalled, expires, or otherwise stops providing real-time protection.
Two things trip people up here. A free trial that expired but was never removed still holds the slot, so uninstall it even though it stopped working. And most antivirus makers leave drivers and registry entries behind after a normal uninstall, which can keep Defender off; the maker’s official removal tool clears those remnants. Run it, then restart again.
Clear a policy or Tamper Protection that’s blocking it
If real-time protection is grayed out or reads “This setting is managed by your administrator,” a policy is holding Defender off, often left behind by a debloating or tuning script. On current Windows 10 and 11 the old DisableAntiSpyware registry value under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender is deprecated and ignored on consumer devices, so deleting it rarely helps on its own. On Windows Pro or a managed machine, the Group Policy Turn off Microsoft Defender Antivirus can still apply. Open gpedit.msc, browse to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus, set that policy and Turn off real-time protection (in the Real-time Protection subfolder) to Not Configured, then restart.
Tamper Protection is separate and, by design, prevents changes to Defender’s important settings such as real-time and cloud-delivered protection. It should stay on in normal use, but if a setting refuses to change, turn it off first at Virus & threat protection > Manage settings > Tamper protection, make the change, then turn it back on. Tamper Protection does not affect how third-party antivirus apps register.
Make sure the Security Center service is running
Windows Security depends on a few background services. If a cleanup tool disabled the Security Center service (wscsvc) or the Windows Security Service (SecurityHealthService), the app can’t report or manage Defender, and Defender may stop detecting other antivirus correctly. Microsoft is explicit that you should not disable, stop, or modify wscsvc, SecurityHealthService, WinDefend, or MsMpEng. If one was switched off, open services.msc, set it back to its default startup, start it, and restart the PC.
WinDefend itself is a protected service you generally can’t and shouldn’t edit by hand. If Defender still looks stuck, run sfc /scannow and then DISM /Online /Cleanup-Image /RestoreHealth from an elevated terminal, or use a System Restore point from before the change. To confirm the result, run Get-MpComputerStatus | select AMRunningMode in PowerShell; a healthy machine returns Normal.
Turn real-time protection back on
With the blocker gone, switch protection on in Windows Security: Virus & threat protection > Virus & threat protection settings > Manage settings, then set Real-time protection to On. If you had only turned it off temporarily, Windows switches it back on by itself after a while.
Keep exactly one real-time antivirus running, and Defender will manage itself from there. If you’re weighing this because Windows 10 has reached end of support, Microsoft Defender on Windows 11 is a solid default that needs no license or renewal. Pair it with the basics that antivirus can’t cover for you: recognizing a phishing email before you click, and turning on two-factor authentication on the accounts that matter.