Match the symptom before changing settings
| What you observe | Where to focus |
|---|---|
| Managed by another provider | Check installed antivirus and organization policy |
| Protection updates fail | Check Windows Update, date, network and free space |
| Real-time protection turns off | Inspect protection history and provider conflicts |
| Defender services are missing | Repair Windows instead of downloading replacement files |
Diagnose Microsoft Defender Antivirus state with evidence first
Reproduce the Defender problem and capture the exact state: real-time protection disabled, service unavailable, update failure, scan failure, or another antivirus shown as active. Those symptoms do not share one cause.
Check the registered antivirus provider and whether the device is personal or organization-managed. If another supported antivirus is active, Defender may intentionally operate in passive mode.
Complete these focused checks: identify the registered security provider; remove only expired antivirus through its official uninstaller; check protection update error codes; run a Microsoft Defender scan after repair. Take screenshots or notes before changing firmware, encryption, recovery, driver or power settings. Those records provide a return path if the first repair does not help.
Update Windows and Defender protection intelligence through supported Microsoft channels. Avoid third-party scripts that claim to force-enable Defender because they can alter services and policy without showing what changed.
Save important files and recovery information before malware or policy troubleshooting. Do not delete security policies, disable tamper protection, or remove antivirus software unless the provider state actually requires it.
Resolve provider conflicts
If another antivirus is installed, decide which supported provider should remain. Use its official removal tool and restart before expecting Defender to resume.
Confirm whether Microsoft Defender is actually the active antivirus provider. If another antivirus is installed and registered, Defender may enter passive or disabled modes intentionally.
1Verification checkpoint
- Recheck the active antivirus provider.
- Confirm real-time protection is in the expected state.
- If another provider remains active by design, do not force Defender on.
Update protection safely
Run Windows Update and protection updates, check date and connectivity, and use Microsoft offline scan when malware interference is suspected.
Check protection services and update status before changing policies or registry values. A service stopped by policy has a different cause from a service failing because of damaged system components.
2Verification checkpoint
- Run a protection intelligence update.
- Confirm the update completes without the original error.
- If it fails, keep the code and investigate update connectivity separately.
Repair system policy and files
Check whether the PC is managed, then run DISM and SFC for genuine component damage. Do not force-enable Defender against organization policy.
If you repair Defender components, make one change at a time and recheck real-time protection and definition updates after each step. Avoid downloading unofficial Defender repair scripts.
3Verification checkpoint
- Restart and verify Defender remains stable.
- Run one normal scan or status check.
- If protection disables itself again, investigate policy, malware, or service configuration.
Interpret the result before escalating
If Defender becomes active after removing or disabling a third-party antivirus, the original behavior was provider handoff rather than a Windows Security failure.
If real-time protection can be enabled but switches off again after reboot, investigate policy, security software, malware, or service configuration instead of repeatedly toggling the switch.
If definition updates fail while the service remains active, treat update connectivity or component health separately from real-time protection.
Verify the fix and choose the safe escalation
Confirm that Windows Security identifies the expected antivirus provider and that real-time protection remains in the intended state after a restart.
Run a normal Microsoft Defender update and verify that the protection intelligence version changes or reports current status without an error.
If Defender cannot stay enabled, services cannot start, or malware is suspected, use Microsoft-supported offline scanning or professional malware-removal steps rather than weakening security settings.
Technical order checked against current Microsoft guidance. Exact controls vary by Windows build, hardware, edition and organization policy.
Frequently asked questions
Why is Defender disabled after installing antivirus?
Windows normally lets the third-party provider handle real-time protection to avoid conflicts.
Can malware disable Defender?
Yes, but policy, another antivirus or damaged components can produce similar symptoms.
How do I update Defender?
Use Windows Security protection updates or Windows Update, not third-party definition downloads.