Fix Windows Defender Blocked by Group Policy

Symptoms

• Windows Defender shows 'This app is blocked by group policy' or error code 0x800704ec.
• Real-time protection cannot be turned on.
• Windows Security app displays 'Your IT administrator has limited access' or similar messages.
• Defender updates fail or are disabled.

Root Causes

• Group policy settings (local or domain) that explicitly disable Windows Defender.
• Registry modifications from third-party security software or malware.
• Corrupted policy files or conflicts between multiple policies.
• Windows Defender itself may have been disabled via Group Policy Editor (gpedit.msc).

Step-by-Step Fix

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Double-click Turn off Microsoft Defender Antivirus.
4. Set it to Not Configured or Disabled, then click OK.
5. Also check Computer Configuration > Administrative Templates > Windows Components > Windows Security and ensure Turn off Windows Security is Not Configured.
6. Open Command Prompt as Administrator and run gpupdate /force to refresh policies.
7. Restart the computer.
8. Open Windows Security and verify Defender is enabled.

Alternative Fixes

Registry Method

1. Open Regedit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
3. Delete the DisableAntiSpyware DWORD value if present.
4. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender and delete DisableAntiSpyware there.
5. Restart.

Reset Group Policy

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Run as Admin, then restart.

Prevention

• Avoid installing multiple antivirus programs simultaneously.
• Regularly scan for malware that may alter policies.
• Keep Windows updated to prevent policy corruption.
• If using domain policies, contact your IT administrator to review security settings.

Additional Notes

If the issue persists, check for third-party security software that may have disabled Defender. Uninstall such programs and re-enable Defender via Windows Security settings. For enterprise environments, domain group policies may override local settings—consult with IT support.

Always back up the registry before making changes. Use System Restore as a safety measure.