The three causes
If Windows Security shows red warnings or 'Real-time protection is off', it's one of:
- A third-party antivirus is installed (Norton, McAfee, Avast, AVG, ESET, Bitdefender, etc.). This is the most common cause and is normal — only one antivirus runs at a time.
- Malware has switched it off. The settings will be greyed out and Tamper Protection may be off too.
- A Group Policy / registry tweak from an old 'tweaker' tool or a former IT admin is forcing it off.
Step 1: Check for third-party antivirus
Settings → Apps → Installed apps. Look for: Norton, McAfee, Avast, AVG, Bitdefender, Kaspersky, ESET, Trend Micro, Webroot, Sophos.
If one is installed and current, Defender is supposed to be off — that is normal Windows behaviour. You only have a problem if you cannot find any antivirus, or you do not know what the listed one is.
Important
HP, Dell and Lenovo laptops often ship with a McAfee or Norton trial that quietly takes over from Defender then expires after 30 days, leaving you unprotected. Uninstall the trial to restore Defender.
Step 2: Check Tamper Protection status
Open Windows Security → Virus & threat protection → Manage settings.
If Tamper Protection is Off, malware may have disabled it. If it is On but other toggles are off and greyed out, a third-party app or policy is in control.
Step 3: Look for malware tampering
Press Win + R, type
eventvwr and press Enter. Navigate to Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.Look for events in the last few days indicating real-time protection was disabled. The Source is usually 'Windows Defender'.
Step 4: Check for forced policy
Press Win + R, type
regedit and press Enter. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.If
DisableAntiSpyware exists and is set to 1, something has forced Defender off. Take a screenshot before changing anything.Important
Do not edit the registry unless you are confident. The 'Lock down Windows' guide and a Malwarebytes scan will fix most cases without registry surgery.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers