How To Enable Windows Defender | Inside Windows Security

Microsoft Defender Antivirus is enabled through Windows Security by toggling Real-time protection under Virus & threat protection settings.

Microsoft Defender Antivirus is already installed on every licensed Windows 10 and 11 PC — but it isn’t always actively running. Uninstalling a third-party antivirus can leave the system exposed if Defender doesn’t automatically restart, and group policy or registry edits can turn it off without warning. Knowing how to enable Windows Defender takes about thirty seconds and costs nothing extra. The main control lives inside the Windows Security app, and the steps work the same on both Windows 10 (version 1809 and later) and all editions of Windows 11.

Enabling Windows Defender: The Settings Toggle That Matters

The fastest route to turn on Defender is through the Windows Security app. This is the same interface that shows your overall protection status, firewall state, and app-and-browser controls.

1. Open the Start menu, type Security, and select Windows Security from the results.
2. Click the Virus & threat protection tile — it has a shield icon and sits in the top row.
3. Under the “Virus & threat protection settings” heading, click Manage settings.
4. Toggle Real-time protection to On. If prompted by User Account Control, click Yes.

A green checkmark on the Windows Security home screen confirms that Defender is active. If the toggle is grayed out, a third-party antivirus is likely installed and responsible for the system’s protection — Defender will reactivate automatically once that other program is removed and the PC is restarted.

What If Windows Defender Won’t Stay On?

When Defender turns itself off repeatedly or refuses to enable, the cause is almost always something else on the system claiming the antivirus role. The most common scenarios and their fixes are straightforward.

Another antivirus is installed. Defender automatically disables when it detects active third-party protection. Uninstall the other program through Settings > Apps > Installed apps, then restart the computer. Defender will re-enable on its own after the reboot.

A group policy or registry change has disabled it. In managed environments, IT admins sometimes push a policy that turns off Defender. If you’re on a personal machine, open Registry Editor and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. Set the DisableAntiSpyware value to 0, then restart. (This is also the fix when a previous registry edit or optimization tool switched it off.)

Persistent malware is interfering. Some infections deliberately disable real-time protection to avoid detection. Run Microsoft Defender Offline Scan — it reboots the system into a recovery environment that can remove rootkits and stubborn threats before Defender is started.

Enable Defender via PowerShell When the GUI Won’t Cooperate

If the Windows Security app is unresponsive or the toggle is missing, PowerShell can force Defender back on. Run Windows PowerShell as Administrator and execute the following commands to re-enable real-time scanning and associated protections:

Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "Real-Time Protection" -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableBehaviorMonitoring" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableOnAccessProtection" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableScanOnRealtimeEnable" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0 -PropertyType DWORD -Force
start-service WinDefend
start-service WdNisSvc

Restart the PC after running these commands. This method overrides most registry-based blocks and is documented by Microsoft’s official Defender documentation as a valid recovery path for persistent disable states.

Common Mistakes That Keep Defender Turned Off

A few recurring errors cause Defender to stay disabled even after a user thinks it’s running. The table below covers the patterns that send people back to search results.

Final Protection Check — Three Things to Verify

Once Defender is enabled, confirm that all layers of protection are actually working. Open Windows Security and check these three items before closing the window.

• Virus & threat protection — a green shield icon and the text “No action needed” means real-time scanning is active. If you see yellow or red, click the tile and turn on any off toggles.
• Firewall & network protection — all three network profiles (Domain, Private, Public) should show a green checkmark. Click each one to turn the firewall on if it’s off.
• App & browser control — Microsoft Defender SmartScreen should be set to Warn for all three options (Edge, apps, and Microsoft Store).

That’s it. Defender handles the rest automatically with definition updates delivered through Windows Update. No subscription, no extra software, and no ongoing maintenance beyond the occasional reboot.