Threat service has stopped. Restart it now: how to fix it in Windows

Applies to: Windows 11 and Windows 10 home and small business PCs. On a work PC, Defender is often controlled by your IT department; contact them before changing anything.

What the message means

The warning appears in Windows Security > Virus & threat protection. It means the Microsoft Defender Antivirus Service (service name WinDefend) has stopped or failed to start. Until it runs again, Defender can’t scan files as you open them.

Common reasons are another antivirus program that switched Defender off, settings left behind after that program was removed, a policy or “tweak” tool that disabled Defender, damaged files, or malware that stops security software on purpose.

Fix 1: Select Restart now and restart the PC

Select Restart now under the message. If Windows asks for permission, select Yes. If the warning clears, also restart the PC to make sure the service starts on its own. If it returns after the restart, work through the fixes below.

Fix 2: Check for another antivirus

When you install another antivirus, Windows turns Microsoft Defender Antivirus off so the two don’t conflict. Defender can stay off if that program was removed badly or its trial expired.

1. Open Windows Security > Virus & threat protection. If another product is listed as your provider, that program is in charge, and the message is expected while Defender is off.
2. Open Settings > Apps > Installed apps (Windows 10: Settings > Apps > Apps & features) and look for antivirus or “internet security” programs, including ones that came with the PC.
3. Uninstall any you don’t use. For a clean removal, use the vendor’s own removal tool (most antivirus makers offer one on their support site).
4. Restart the PC and check Windows Security again.

If you want to keep the other antivirus, keep it up to date and ignore the Defender message; running two real-time scanners at once isn’t recommended.

Fix 3: Check the Defender service

Right-click Start, open Terminal (Admin) and run:

Get-Service WinDefend, WdNisSvc | Format-Table Name, Status, StartType

WinDefend should be Running with start type Automatic. If it’s stopped, try Start-Service WinDefend. If it won’t start, or the start type is Disabled, something is turning it off, usually a policy (Fix 4) or another product (Fix 2).

Microsoft doesn’t support changing Defender’s service settings by hand, and Windows usually blocks it, so fix the cause instead of forcing the service.

Fix 4: Remove policies that turn Defender off

Old antivirus programs, privacy “tweak” tools and some guides disable Defender with a policy. If Windows Security says Some settings are managed by your organization on a home PC, this is likely the cause.

On Windows Pro, Enterprise or Education:

1. Press Windows + R, type gpedit.msc and press Enter.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus (called Windows Defender Antivirus on older versions).
3. Open Turn off Microsoft Defender Antivirus, set it to Not Configured and select OK.
4. Also check the Real-time Protection folder below it and set any enabled “Turn off” policies to Not Configured.

On any edition (including Home), check the registry:

1. Press Windows + R, type regedit and press Enter.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
3. Right-click the Windows Defender key and choose Export to save a backup.
4. If you see DisableAntiSpyware or DisableAntiVirus in the right pane, right-click each and choose Delete. Do the same for values in a Real-Time Protection subkey, if there is one.
5. Restart the PC.

If Windows won’t let you delete the values, leave them and continue with the next fixes rather than forcing permissions; Defender’s own protection may be blocking the change.

Fix 5: Update Defender

A broken or very old update can stop the service. Open Windows Security > Virus & threat protection > Protection updates and select Check for updates. Then install any waiting updates in Settings > Windows Update.

If the button doesn’t work, run this in an admin Command Prompt:

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate

Fix 6: Repair Windows Security and system files

Run these commands in Terminal (Admin), one at a time, and restart afterwards:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If the Windows Security app itself won’t open or shows a blank page, repair or reset it as described in Windows Security not opening in Windows 11.

Fix 7: Rule out malware

Some malware stops Defender so it can’t be removed. If the service keeps stopping and no other antivirus or policy explains it, scan with a tool that doesn’t depend on Defender, such as the free Microsoft Safety Scanner or another reputable on-demand scanner, and see how to scan for malware in Windows.

If Defender runs again, also start a Microsoft Defender Offline scan from Windows Security > Virus & threat protection > Scan options. It restarts the PC and scans before Windows loads. Unwanted browser add-ons and toolbars are covered in our adware removal guide.

Related guides

• Windows Security not opening in Windows 11: how to fix it
• How to scan for malware in Windows
• Adware removal: how to get rid of pop-ups and unwanted software

Official sources: for more detail, see these Microsoft pages:

• Microsoft Learn: Microsoft Defender Antivirus and non-Microsoft antivirus solutions
• Microsoft Learn: Microsoft Defender Antivirus in the Windows Security app

Frequently asked questions

Is my PC unprotected when the threat service has stopped?

Real-time scanning by Defender is off until the service runs again. If another antivirus is active, that program protects you instead; if not, fix the problem soon and avoid opening unknown files in the meantime.

Can I start the Defender service in Services?

Usually not. Its options are greyed out in services.msc because Windows protects it. Use Restart now in Windows Security or remove what’s turning it off.

Why did the message appear after I uninstalled my antivirus?

Its uninstaller may have left a setting that keeps Defender disabled. Run the vendor’s removal tool, restart, and check for policies as in Fix 4.

Does turning off Tamper Protection help?

Not as a fix. Tamper Protection stops apps from changing Defender settings, which helps protect you. Leave it on unless a specific step requires otherwise, and turn it back on afterwards.