You open Windows Security, turn on real-time protection, and it looks fine. Then you close the window, open it again, and it's off. Or you get a pop-up: "Real-time protection is off. Tap to turn on." But that button does nothing. I've seen this on Windows 10 and 11 right after a feature update, or when a third-party antivirus like Malwarebytes or AVG was removed but left a mess behind. Sometimes it happens for no obvious reason at all.
Why does this happen?
Windows Defender's real-time protection depends on two services: the Windows Defender Antivirus Service (WinDefend) and the Windows Security Service (SecurityHealthService, or something similar on older builds). If either one is stopped or disabled, real-time protection won't start. The most common culprit is the Windows Security Service getting set to "Disabled" after an update or after uninstalling another security program. In older versions of Windows 10, the registry key DisableAntiSpyware also blocks it.
The fix: restart the services
- Press Windows Key + R, type
services.msc, hit Enter. - Find Windows Defender Antivirus Service. Right-click it, choose Properties. Set Startup type to Automatic. Click Start (if it's not running). Click OK.
- Find Windows Security Service (or Security Center on Windows 10 1909 and older). Same deal: set to Automatic, start it.
- Also check Security Health Service if you see it. Set to Automatic.
- Close Services, open Windows Security, and try turning on real-time protection again.
If that didn't work, move to the registry fix.
Check the registry for malware or leftover settings
I've seen some low-grade malware or bad uninstallers put a key in the registry that tells Defender to stay off.
- Press Windows Key + R, type
regedit, hit Enter. - Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. - Look on the right side for a value named DisableAntiSpyware. If it's there and set to 1, delete it or set it to 0.
- Also check
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defenderfor the same value. Delete it if it's set to 1. - Close regedit, restart your PC.
Group Policy override (if you're on Pro or Enterprise)
If someone configured Group Policy to turn off Defender, you'll need to fix that.
- Press Windows Key + R, type
gpedit.msc, hit Enter. - Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
- Double-click Turn off Microsoft Defender Antivirus. Set it to Not Configured.
- Click OK. Close the editor.
What to check if it still fails
If none of the above works, you're probably dealing with a corrupted Windows install or leftover garbage from a third-party antivirus. Run the System File Checker by opening Command Prompt as admin and typing sfc /scannow. Let it finish. Then try the services fix again.
Another thing: if you're using a VPN that includes a security suite (like Norton or Bitdefender), that can block Defender. Uninstall the VPN's security features and see if that helps. I've seen this with NordVPN's Threat Protection and ExpressVPN's Web Protection.
Worst case, you can do a repair install of Windows using the Media Creation Tool. That keeps your files and apps but replaces the system files. It's a pain, but it works when nothing else does.