Can't turn on Microsoft Defender? How to fix it
Microsoft Defender turns itself off when another antivirus is installed. Fully remove that program, clear any blocking policy, and switch protection back on.
If Windows Security says Microsoft Defender is turned off and the switch won’t stay on, that usually isn’t a bug. Defender steps aside on purpose when another antivirus is installed, and it stays off until that program is completely gone. Uninstall the other antivirus, clear any leftover policy, confirm the Security Center service is running, and Defender comes back on almost every time. Here is how to work through it on Windows 11 and Windows 10. If the switch is instead greyed out and reads This setting is managed by your administrator, a leftover policy is the cause rather than a rival antivirus — and note that on Windows 10, which reached end of support on October 14, 2025, these steps still work and Defender keeps getting security intelligence updates through October 2028, but the OS itself no longer gets fixes, so Windows 11 is the safer long-term home.
Find what’s actually protecting the PC
Open the Windows Security app (search Windows Security from Start) and select Virus & threat protection. If you see another product’s name, or a line about using other antivirus providers, Defender has handed off protection rather than failed. To confirm which app is registered, go to Virus & threat protection > Who’s protecting me? > Manage providers and look under Antivirus.
On Windows 10 and Windows 11 without the enterprise Defender for Endpoint product, Microsoft Defender Antivirus turns itself off automatically when a non-Microsoft antivirus is installed. So the first question is never “why is Defender broken” but “what else is running?”
| What you see | Likely cause | Fix |
|---|---|---|
| Another antivirus is listed as your provider | A third-party AV is installed and registered | Uninstall it fully, then restart |
| Toggle turns on, then flips back off | Leftover files or an expired trial AV | Run the vendor’s removal tool |
| Real-time protection is grayed out or “managed” | A Group Policy or leftover registry policy | Set the policy to Not Configured |
| Windows Security won’t open or shows errors | The Security Center service is stopped | Restore its default startup and start it |
| The switch won’t change at all | Tamper Protection is guarding the setting | Turn Tamper Protection off first |
Uninstall any third-party antivirus completely
Defender will not resume while another real-time antivirus is registered, so remove it. On Windows 11 use Settings > Apps > Installed apps; on Windows 10 use Control Panel > Programs and Features. Uninstall the security product, then restart. Microsoft says Defender re-enables automatically once the other product is uninstalled, expires, or otherwise stops providing real-time protection.
Two things trip people up here. A free trial that expired but was never removed still holds the slot, so uninstall it even though it stopped working. And most antivirus makers leave drivers and registry entries behind after a normal uninstall, which can keep Defender off; the maker’s official removal tool clears those remnants. Run it, then restart again.
Clear a policy or Tamper Protection that’s blocking it
If real-time protection is grayed out or reads “This setting is managed by your administrator,” a policy is holding Defender off, often left behind by a debloating or tuning script. On current Windows 10 and 11 the old DisableAntiSpyware registry value under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender is deprecated and ignored on consumer devices, so deleting it rarely helps on its own. On Windows Pro or a managed machine, the Group Policy Turn off Microsoft Defender Antivirus can still apply. Open gpedit.msc, browse to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus, set that policy and Turn off real-time protection (in the Real-time Protection subfolder) to Not Configured, then restart.
Tamper Protection is separate and, by design, prevents changes to Defender’s important settings such as real-time and cloud-delivered protection. It should stay on in normal use, but if a setting refuses to change, turn it off first at Virus & threat protection > Manage settings > Tamper protection, make the change, then turn it back on. Tamper Protection does not affect how third-party antivirus apps register.
Make sure the Security Center service is running
Windows Security depends on a few background services. If a cleanup tool disabled the Security Center service (wscsvc) or the Windows Security Service (SecurityHealthService), the app can’t report or manage Defender, and Defender may stop detecting other antivirus correctly. Microsoft is explicit that you should not disable, stop, or modify wscsvc, SecurityHealthService, WinDefend, or MsMpEng. If one was switched off, open services.msc, set it back to its default startup, start it, and restart the PC.
WinDefend itself is a protected service you generally can’t and shouldn’t edit by hand. If Defender still looks stuck, run sfc /scannow and then DISM /Online /Cleanup-Image /RestoreHealth from an elevated terminal, or use a System Restore point from before the change. To confirm the result, run Get-MpComputerStatus | select AMRunningMode in PowerShell; a healthy machine returns Normal.
Turn real-time protection back on
With the blocker gone, switch protection on in Windows Security: Virus & threat protection > Virus & threat protection settings > Manage settings, then set Real-time protection to On. If you had only turned it off temporarily, Windows switches it back on by itself after a while.
Keep exactly one real-time antivirus running, and Defender will manage itself from there. If you’re weighing this because Windows 10 has reached end of support, Microsoft Defender on Windows 11 is a solid default that needs no license or renewal. Pair it with the basics that antivirus can’t cover for you: recognizing a phishing email before you click, and turning on two-factor authentication on the accounts that matter.
Common questions
Why does Microsoft Defender say “This setting is managed by your administrator”?
That message means a Group Policy or a leftover registry policy is holding real-time protection off, often left behind by a debloating or tuning script. On Windows Pro, open gpedit.msc and set Turn off Microsoft Defender Antivirus and Turn off real-time protection to Not Configured, then restart.
Will Microsoft Defender still get updates on Windows 10 after end of support?
Yes. Microsoft has committed to delivering security intelligence (definition) updates for Microsoft Defender Antivirus on Windows 10 through October 2028, even though the operating system stopped getting security fixes on October 14, 2025. The definitions keep detection current, but they do not patch the OS itself, so an unsupported Windows 10 is still riskier over time.
How do I check whether Microsoft Defender is actually running?
Open PowerShell and run Get-MpComputerStatus | select AMRunningMode. A healthy machine with Defender in charge returns Normal; a value like Passive or EDR Block Mode means another product is handling real-time protection.
Does Microsoft Defender turn off automatically when I install another antivirus?
Yes, and that is by design. On consumer Windows 10 and 11, Defender steps into passive mode when a non-Microsoft real-time antivirus is registered, and it re-enables on its own once that product is fully uninstalled, expires, or stops providing protection.