Fix Windows Defender Blocked by Group Policy

Symptoms

Users may encounter one or more of the following:

• Windows Defender is turned off and cannot be turned on manually.
• Error message: "This setting is managed by your administrator."
• Windows Security app shows yellow or red warning.
• Real-time protection, cloud-delivered protection, or automatic sample submission is grayed out.
• Event ID 5007 or 5010 in Event Viewer under Microsoft-Windows-Windows Defender/Operational.

Root Causes

Windows Defender can be disabled via Group Policy in several ways:

• Local Group Policy Editor (gpedit.msc) settings.
• Domain Group Policy from an Active Directory environment.
• Corrupt or malicious registry modifications.
• Third-party antivirus disabling Defender via policy.
• Windows 10/11 Home edition limitations (no gpedit.msc).

The most common policy is Turn off Windows Defender Antivirus located under Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus.

Step-by-Step Fix

Step 1: Check Group Policy Settings

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Double-click Turn off Microsoft Defender Antivirus.
4. If set to Enabled, change to Not Configured or Disabled.
5. Click Apply and OK.
6. Repeat for any other policies like Allow antimalware service to startup with normal priority or Configure local setting override for reporting to Microsoft MAPS.

Step 2: Reset Registry Keys

If Group Policy is not the issue, registry values may be overriding.

1. Open Registry Editor (regedit) as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
3. Delete the DisableAntiSpyware DWORD value if present (set to 1 disables Defender).
4. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Policy\Manager and delete any conflicting values.
5. Restart the computer.

Step 3: Force Apply Local Policy

1. Open Command Prompt as Administrator.
2. Run gpupdate /force to refresh policies.
3. Run gpresult /h C:\gp_report.html and open the report to verify applied policies.

Step 4: Re-register Windows Defender

1. Open PowerShell as Administrator.
2. Run:

   Set-MpPreference -DisableRealtimeMonitoring $false

3. If that fails, run:

   Uninstall-WindowsFeature -Name Windows-Defender

   (Note: This may not work on all versions; use with caution.)

Alternative Fixes

• Windows 10/11 Home: Since gpedit.msc is not available, use the Registry Editor method above. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender for policy keys.
• Third-party antivirus conflict: Uninstall any other antivirus software and reboot. Defender should activate automatically.
• SFC and DISM: Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair system files.
• Reset Windows Security app: Go to Settings > Apps > Microsoft Store > Advanced options > Reset.

Prevention

• Avoid installing multiple antivirus products simultaneously.
• Regularly audit Group Policy settings, especially after domain changes.
• Use gpresult to monitor applied policies.
• Keep Windows updated to avoid policy bugs.
• For enterprise environments, ensure Defender policies are correctly configured in Group Policy Management Console.