How to Fix Windows Defender Keeps Turning Off or Won't Enable on Windows 11 (2026 Guide)

Why Does Windows Defender Keep Turning Off on Windows 11?

Microsoft Defender Antivirus is Windows 11's built-in security solution — and when it suddenly turns itself off, becomes greyed out, or refuses to re-enable, your PC is left completely unprotected. This is one of the most-searched Windows 11 security problems in 2026, affecting millions of home and business users alike.

The frustrating part is that Defender can be silenced by multiple different causes: a third-party antivirus conflict, a Group Policy misconfiguration, a corrupted registry key, a tampered security service, or even malware deliberately disabling your protection. This guide walks you through every fix, from the simplest to the most advanced.

Fix 1: Check Whether a Third-Party Antivirus Is Installed

Windows 11 is designed to automatically disable Microsoft Defender when another antivirus product is installed and active. This is intentional — running two real-time antivirus engines simultaneously can cause system slowdowns and conflicts. If you have McAfee, Norton, Avast, Bitdefender, or any other security suite installed, Defender will stay off.

Steps

1. Open Settings > Apps > Installed apps.
2. Search for any third-party antivirus product.
3. If found and you no longer want it, click the three-dot menu and select Uninstall.
4. Restart your PC. Windows Defender should re-enable automatically within a few minutes.

If you want to keep your third-party antivirus, this behaviour is expected — Defender will remain disabled as a secondary scanner.

Fix 2: Enable Tamper Protection

Tamper Protection is a Windows 11 feature that prevents malware, rogue apps, and even unauthorized system changes from disabling Defender. If Tamper Protection was turned off — either manually or by malware — Defender can be silently switched off without any warning.

Steps

1. Open Windows Security from the Start menu or system tray.
2. Click Virus & threat protection.
3. Scroll down and click Manage settings under Virus & threat protection settings.
4. Toggle Tamper Protection to On.

If Tamper Protection is greyed out, it means a Group Policy or registry entry is overriding it. Proceed to Fix 3 or Fix 4 below.

Fix 3: Fix the Group Policy Setting (Windows 11 Pro and Enterprise)

On Windows 11 Pro and Enterprise editions, administrators can disable Defender via the Local Group Policy Editor. If this policy was applied incorrectly — or by malware — it will override all manual attempts to re-enable Defender and cause Tamper Protection to appear greyed out.

Steps

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
3. Double-click Turn off Microsoft Defender Antivirus.
4. Set it to Not Configured (not Disabled — "Not Configured" is the correct state for a working Defender).
5. Click Apply, then OK.
6. Restart your PC.

Note: Windows 11 Home does not include the Group Policy Editor. If you are on Home edition, skip to Fix 4.

Fix 4: Remove the Disabling Registry Key

Even on Windows 11 Home, a registry DWORD value called DisableAntiSpyware can force Defender off. This key is sometimes set by old antivirus uninstallers, system tweaking tools, or malware. Removing it directly from the registry restores Defender's ability to run.

Steps

1. Press Win + R, type regedit, and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
3. Look for a DWORD value named DisableAntiSpyware.
4. If it exists, right-click it and select Delete.
5. Also check: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection for a value named DisableRealtimeMonitoring and delete it if present.
6. Close Registry Editor and restart your PC.

Warning: Only delete the specific keys mentioned above. Modifying other registry entries can destabilize Windows.

Fix 5: Restart the Windows Security Center Service

Windows Defender relies on the Security Center service to operate. If this service has crashed, stopped, or been set to Disabled, Defender's real-time protection will shut down even if no policy or registry change is present.

Steps

1. Press Win + R, type services.msc, and press Enter.
2. Scroll down and find Security Center.
3. Right-click it and select Restart. If it shows Stopped, click Start.
4. Double-click the service, set Startup type to Automatic, and click OK.
5. Also check the Windows Defender Antivirus Service — right-click and restart it as well.

After restarting both services, open Windows Security and check whether real-time protection has re-enabled.

Fix 6: Run SFC and DISM to Repair System Files

Corrupted Windows system files can prevent Defender from starting or make it appear broken. The built-in System File Checker (SFC) and Deployment Image Servicing and Management (DISM) tools scan for and repair these corruptions without requiring a Windows reinstall.

Steps

1. Right-click the Start button and select Terminal (Admin) or Command Prompt (Admin).
2. Run the DISM repair first: DISM /Online /Cleanup-Image /RestoreHealth — wait for it to complete (can take 10–20 minutes).
3. Then run SFC: sfc /scannow
4. Restart your PC when both scans complete.
5. Open Windows Security and check if Defender is now active.

Fix 7: Reset the Windows Security App

The Windows Security app itself can become corrupted or misconfigured. Resetting it via PowerShell reinstalls the app's components to their default state, which often resolves cases where Defender appears stuck, greyed out, or unavailable.

Steps

1. Right-click the Start button and select Terminal (Admin).
2. Run this PowerShell command to reset the Windows Security app: Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
3. Wait for the command to complete, then restart your PC.
4. Open Windows Security — it should now show all protections as active.

Fix 8: Scan for Malware Using Windows Defender Offline Scan

Some malware is specifically designed to disable Windows Defender before it can be detected. If none of the above fixes have worked, malware may be actively fighting back. The Windows Defender Offline Scan runs before Windows fully boots, making it impossible for most malware to hide or interfere.

Steps

1. Open Windows Security > Virus & threat protection.
2. Under Current threats, click Scan options.
3. Select Microsoft Defender Antivirus (Offline Scan) and click Scan now.
4. Your PC will restart and run the scan before Windows loads. This takes approximately 15 minutes.
5. After the scan completes and Windows boots, check whether Defender is now active.

If malware was found and removed, revisit Fix 2 to ensure Tamper Protection is enabled so this cannot happen again.

How to Verify Windows Defender Is Fully Active

After applying the fixes above, confirm that all protections are running correctly:

1. Open Windows Security from the Start menu.
2. Click Virus & threat protection. You should see "No action needed" and a green checkmark.
3. Verify that Real-time protection, Cloud-delivered protection, and Automatic sample submission are all toggled On.
4. Run a quick test: open PowerShell and type Get-MpComputerStatus — look for RealTimeProtectionEnabled : True in the output.

If you are still seeing issues after all of the above steps, it is time to bring in a professional. Get expert help from CloudHouse Technologies — our certified technicians can diagnose and resolve even the most stubborn Defender issues remotely.

Frequently Asked Questions

Why does Windows Defender keep turning off automatically?

The most common reason is a third-party antivirus product being installed. Windows 11 intentionally disables Defender when another real-time scanner is active. Other causes include a Group Policy setting, a registry DisableAntiSpyware key, or malware that has tampered with the security services.

Can malware disable Windows Defender?

Yes. Some malware specifically targets Tamper Protection and the Security Center service to disable Defender before it can be detected. If Defender turns off suddenly and you did not change any settings, run an offline scan immediately using a bootable rescue tool or Windows Defender Offline Scan.

Windows Defender is greyed out — why can't I enable it?

A greyed-out Defender toggle almost always means a Group Policy setting or registry key is overriding the user interface. On Windows 11 Pro/Enterprise, check gpedit.msc. On all editions, check the registry path HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender for a DisableAntiSpyware DWORD.

Is it safe to run Windows 11 without Windows Defender?

No. Without real-time protection, your system is fully exposed to ransomware, trojans, spyware, and zero-day exploits. While other antivirus products can replace Defender, your PC should never run without any active antivirus. If Defender is off and you have no replacement, fix it immediately.

Will reinstalling Windows fix Windows Defender not working?

A full Windows reinstall is a last resort that is almost never required. The SFC scan, DISM repair, and Windows Security app reset (Fix 6 and Fix 7 above) can repair corrupted files without losing your data or applications. Only consider a fresh install if all other methods have failed.