How to Tell Why Windows Defender Is Turned Off
Three things can disable Defender. Knowing which one tells you what to do next.
5 min read · Beginner friendly
The three causes
If Windows Security shows red warnings or 'Real-time protection is off', it's one of:
- A third-party antivirus is installed (Norton, McAfee, Avast, AVG, ESET, Bitdefender, etc.). This is the most common cause and is normal — only one antivirus runs at a time.
- Malware has switched it off. The settings will be greyed out and Tamper Protection may be off too.
- A Group Policy / registry tweak from an old 'tweaker' tool or a former IT admin is forcing it off.
Step 1: Check for third-party antivirus
Settings → Apps → Installed apps. Look for: Norton, McAfee, Avast, AVG, Bitdefender, Kaspersky, ESET, Trend Micro, Webroot, Sophos.
If one is installed and current, Defender is supposed to be off — that is normal Windows behaviour. You only have a problem if you cannot find any antivirus, or you do not know what the listed one is.
HP, Dell and Lenovo laptops often ship with a McAfee or Norton trial that quietly takes over from Defender then expires after 30 days, leaving you unprotected. Uninstall the trial to restore Defender.
Step 2: Check Tamper Protection status
Open Windows Security → Virus & threat protection → Manage settings.
If Tamper Protection is Off, malware may have disabled it. If it is On but other toggles are off and greyed out, a third-party app or policy is in control.
Step 3: Look for malware tampering
Press Win + R, type eventvwr and press Enter. Navigate to Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.
Look for events in the last few days indicating real-time protection was disabled. The Source is usually 'Windows Defender'.
Step 4: Check for forced policy
Press Win + R, type regedit and press Enter. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
If DisableAntiSpyware exists and is set to 1, something has forced Defender off. Take a screenshot before changing anything.
Do not edit the registry unless you are confident. The 'Lock down Windows' guide and a Malwarebytes scan will fix most cases without registry surgery.