An integrated threat protection solution designed to detect, investigate, and respond to cyber threats across Microsoft 365 services.
Since uninstalling/reinstalling the Microsoft Defender app and restarting did not help, use this troubleshooting path:
- Check whether the Defender services are running.
Open PowerShell as administrator and run:
Expected results include:Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status- WinDefend = Automatic, Running
- SecurityHealthService = Manual, Running
- wscsvc = Automatic, Running
- WdFilter = Boot, Running
- WdBoot being Stopped after boot is normal
- Review Defender event logs.
Open Event Viewer and go to:
Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational Check for these events:
- Event 5007: Defender configuration changed
- Event 5001: Real-time protection was disabled
- Rule out interference from other antivirus software. If Microsoft Defender Antivirus is intended to be the primary antivirus, uninstall any non-Microsoft antivirus software.
- Run Microsoft Safety Scanner to rule out malware.
- Reset Defender definitions and platform.
Open Command Prompt as administrator and run:
MpCmdRun.exe -RemoveDefinitions -All MpCmdRun.exe -ResetPlatform - Back up and remove Defender policies.
Warning: this removes Microsoft Defender Antivirus policy settings from the local machine. In PowerShell as administrator, back up the policies:
Then remove the policies:New-Item -Path "C:\DefenderTemp" -ItemType Directory; Invoke-Command {reg export 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender' C:\DefenderTemp\_DefenderAVBackup.reg}Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force - Run Microsoft Update, then verify Tamper Protection is enabled.
For the Microsoft Defender app itself on Windows, installation alone does not activate it. The app must be signed in with the Microsoft account used for Microsoft 365. If the app is uninstalled, it is not automatically reinstalled and must be installed again manually from the Store.
References: