You're not alone, and this is fixable
It's maddening when Windows Security decides it won't turn on, and you're left staring at a greyed-out toggle. I've seen this on Windows 10 and 11 after a sudden crash, a botched update, or when you uninstalled a third-party antivirus and it left junk behind. The good news is you don't need to reinstall Windows.
The fix that works most of the time
Here's the step that resolves this for the majority of people. Open PowerShell as Administrator (right-click Start, choose "Windows PowerShell (Admin)" or "Terminal (Admin)"). Then run these commands one by one:
Set-Service WinDefend -StartupType Automatic
Set-Service WdNisSvc -StartupType Automatic
Set-Service SecurityHealthService -StartupType Automatic
Set-Service wscsvc -StartupType Automatic
Start-Service WinDefend
Start-Service WdNisSvc
Start-Service SecurityHealthService
Start-Service wscsvc
After that, restart your PC. When you log back in, open Windows Security and try turning on "Virus & threat protection" again.
What's actually happening here is that those Windows services got their startup type changed to "Disabled" or "Manual" — often by the leftover uninstaller of a third-party AV, or by a system crash that corrupted the service control manager's state. Once you force them back to Automatic and start them, Defender can initialize normally.
Why this works
Windows Defender isn't a single program. It relies on a chain of services: WinDefend is the core engine, WdNisSvc handles network inspection, SecurityHealthService runs the Security Center UI, and wscsvc is the Windows Security Center that reports status to the Action Center. If any of these is disabled, the whole Security app shows that ugly red banner and the toggle is unresponsive. By setting them all to Automatic and starting them in the right order, you're re-establishing that chain. The order matters less than actually starting them — but doing it in the sequence above mimics how they load at boot.
If that didn't do it — the less common variations
Sometimes the services are already set to Automatic, but Defender still won't start. That points to a deeper issue. Here are the variations I've hit and what actually fixed them.
1. Tamper Protection is blocking you
If Tamper Protection is enabled, it prevents any changes to Defender's settings — including via PowerShell. You might see an error like "This operation is not allowed" when you try to start WinDefend. Fix: go to Windows Security > Device security > Core isolation details, and turn off Tamper Protection. Then run the commands again, and turn Tamper Protection back on afterward. It's a security feature, but it can get confused after a crash and lock things down too aggressively.
2. The WMI repository is corrupt
Windows Management Instrumentation (WMI) is what the Security Center uses to query Defender's state. If the WMI repository is damaged, Windows Security shows false statuses. You'll often see this if the Event Viewer logs show WMI errors around the time of the problem. Fix:
net stop winmgmt
winmgmt /resetrepository
net start winmgmt
Run those in an admin Command Prompt. This rebuilds the WMI database from scratch. It's safe, though it may reset some management settings. After a reboot, check Windows Security again.
3. Remnants of a third-party AV
Even after you uninstall Norton or McAfee, their kernel drivers can linger. Those drivers hook into the same system calls Defender uses, and when they're half-removed, Defender refuses to start because it thinks another AV is active. Use the vendor's official removal tool (they all have one — Norton Removal Tool, McAfee Consumer Product Removal tool, etc.). If that's not enough, boot into Safe Mode and check for leftover services with sc query or just look in Device Manager under "Non-plug and Play Drivers" for anything with the vendor's name. Disable those, then restart normally and run the PowerShell commands from earlier.
4. Group Policy override
On Windows Pro or Enterprise, a leftover Group Policy can disable Defender. Run gpedit.msc and navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. If "Turn off Microsoft Defender Antivirus" is set to "Enabled," set it to "Not Configured." Then run gpupdate /force in an admin Command Prompt. This is less common on home machines, but I've seen it after someone fiddled with policies and then forgot.
Preventing this from happening again
Here's the honest take: you can't fully prevent crashes or update glitches, but you can reduce the chance that they break Defender.
- Don't install third-party antivirus unless you have a specific reason. Windows Defender is genuinely solid on Windows 10 and 11, and third-party AVs are the number one cause of service conflicts like this.
- If you do uninstall one, use the official removal tool, not just "Add or remove programs." The uninstaller often leaves drivers behind.
- Keep Windows Update running. Many Defender glitches are fixed in cumulative updates. A system stuck on an old build is more prone to these issues.
- After a crash, check Event Viewer for service errors before you assume things are fine. Look under Windows Logs > System for events from "Service Control Manager" with source "Service Control Manager" — if you see errors about WinDefend or SecurityHealthService, restart those services immediately.
One more thing: if you ever see the toggle greyed out and the "Use available protection" button, click that first. It often triggers a repair scan that fixes the service chain without any manual steps. I've seen it work more times than I'd expect from a button that looks like a placeholder.
If none of this gets you running, you might be dealing with a corrupt system image. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth in that order. But honestly, in my experience, the service startup commands fix 80% of these cases. Start there.