You set Google or another provider as your default, but every time you open Microsoft Edge the search keeps flipping back to Bing. That kind of stubborn, repeating change can mean two things are worth checking. First, the setting itself may simply need to be reapplied inside Edge. Second, something on your PC may be overriding your choice, and one possible culprit is unwanted software that has quietly disabled your built-in protection. The steps below start by making sure Windows is actually guarding your machine, then scan for anything that could be resetting your preferences behind your back, and finish by pointing you back to the browser setting itself. Start at the top and stop as soon as the problem clears.
Confirm Your Built-In Protection Is Still Watching
The fastest first move is to make sure Microsoft Defender Antivirus, which comes built into Windows 10 and Windows 11, is on duty. If real-time protection has been switched off, malicious software can change settings more freely, including the values your browser reads when it picks a search provider.
Open the Windows Security app by searching for it in the Start menu. On Windows 10 you can also reach it through Start > Settings > Update & Security > Windows Security > Virus & threat protection. Inside the app, select Virus & threat protection to land on the main protection screen.
Turn Real-Time Protection Back On
With the protection screen open, you can verify the live scanner is running and re-enable it if it was disabled. While real-time protection is off, files you open or download will not be scanned for threats, which gives unwanted software more room to keep editing your preferences.
- 1.In the Windows Security app, select Virus & threat protection > Manage settings.
- 2.Find the Real-time protection toggle and switch it On.
For a direct route to that page, you can run the Windows shortcut windowsdefender://threatsettings/, which opens Virus & threat protection > Manage settings where the Real-time protection and Tamper protection toggles live. Microsoft notes that if you turn real-time protection off, it will turn back on automatically after a short while to resume protecting your device.
Rule Out a Second Antivirus Doing the Switching
If you found real-time protection already off, do not assume the worst right away. When you install a compatible non-Microsoft antivirus program, Microsoft Defender Antivirus automatically turns itself off, and that is expected behavior rather than a fault.
Think about whether you recently added another security suite. Because Microsoft Defender Antivirus comes built into Windows 10 and Windows 11, it turns back on automatically if you uninstall the other app. If a third-party tool is present, check that tool's own protection status too, since whatever is scanning your system is the layer that should catch software meddling with your search setting.
Clear the Tamper Protection Gate If a Toggle Is Locked
Sometimes you try to flip the Real-time protection switch and it simply will not move. That usually means Tamper Protection is doing its job. Tamper protection helps prevent malicious apps from changing important Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection, and it is turned on by default for consumers.
To adjust the protection toggles, you may need to clear this gate first. Treat this as a temporary change only, because turning tamper protection off lowers a safeguard that is meant to stop rogue software from disabling your defenses. Turn it back on as soon as you are done.
- 1.In the Windows Security app, select Virus & threat protection > Manage settings.
- 2.Use the Tamper protection toggle to turn it On or Off.
Microsoft is explicit here: if tamper protection is turned on, you will need to turn it off before you can turn Real-time protection off. If tamper protection is on and you are an administrator, you can still change these settings inside the Windows Security app, but other apps cannot. That last point matters for your search problem, because it means tamper protection blocks rogue software from quietly disabling your defenses. Leaving it on is the safer choice once you have finished any changes.
Scan for the Software That Keeps Resetting Your Search
With protection confirmed, the next job is to hunt down anything that might be forcing the search engine back to Bing. A scan checks your files for known threats so you are not just treating the symptom in the browser.
Start with the faster option, then escalate if you still suspect a problem.
- 1.In the Windows Security app, go to Virus & threat protection.
- 2.Under Current threats, select Quick scan for a fast check.
- 3.If you want a deeper look, select Scan options, choose Full scan, then select Scan now.
Microsoft notes that a Quick scan is useful when you do not want to spend the time running a full scan on all files and folders. If you think your PC is infected with malware, a full scan is recommended, and your PC might be a little slower while it runs because it looks everywhere for possible problems. You can also jump straight to a scan with the shortcuts windowsdefender://quickscan/ for a quick check, windowsdefender://fullscan/ for a full scan, or windowsdefender://customscan/ to target specific locations.
Catch Persistent Malware With an Offline Scan
If the search engine keeps reverting even after a Full scan comes back clean, you may be dealing with malware that hides while Windows is running. A Microsoft Defender Offline scan is built for exactly this situation, and it is included in Windows 10 and Windows 11.
Save any open files before you start, because your PC will restart as part of the process.
- 1.In the Windows Security app, select Virus & threat protection > Scan options.
- 2.Choose Microsoft Defender Antivirus (offline scan).
- 3.Select Scan now.
On Windows 10 you can reach the same place via Start > Settings > Update & Security > Windows Security > Virus & threat protection > Scan options. After you start it, the PC restarts, Microsoft Defender Offline loads and performs a scan in the Windows Recovery Environment, then the PC restarts automatically. The shortcut windowsdefender://wdoscan/ launches the same offline scan directly.
Microsoft recommends the offline scan when you are concerned your device has been exposed to malware or a virus, because it runs after a restart without loading Windows, so persistent malware has a harder time hiding. Once your PC comes back up, view the results in the Windows Security app under Protection history.
Add a Second Opinion With a Standalone Scanner
If you want extra reassurance after the built-in scans, Microsoft offers a separate on-demand tool. Microsoft Safety Scanner is a standalone download that runs only when you ask it to, and it can coexist with other real-time security software already on your machine.
Because it does not stay resident, it is handy as a one-time second look at a system that keeps misbehaving. Run it, let it finish, and compare its findings against what your offline scan reported. A clean result from both tools strongly suggests the search change is coming from a browser setting or extension rather than a system-level infection.
Reapply the Search Engine Inside Edge Itself
Once the scans are clean, the change is most likely living inside the browser, so set your preference again in Microsoft Edge. Open the Edge settings menu, look for the section that controls the address bar and search, and choose the search engine you want as your default. If you originally added that provider by visiting its site, make sure it is still listed so you can select it.
While you are in Edge, review your installed extensions and remove anything you do not recognize or did not deliberately add, since a stray add-on can force the search provider back to Bing. After you make these changes, close Edge completely and reopen it to confirm the new default sticks. If it holds after a clean malware sweep, you have addressed both the cause and the symptom.
Frequently Asked Questions
Why does my real-time protection keep showing as off?
The most common reason is a compatible non-Microsoft antivirus program. When you install one, Microsoft Defender Antivirus automatically turns itself off, which is expected behavior. If you uninstall the other app, Defender turns back on automatically.
Why can't I move the Real-time protection toggle?
Tamper Protection is likely on. Microsoft states that if tamper protection is turned on, you need to turn it off before you can turn Real-time protection off. Go to Virus & threat protection > Manage settings and switch Tamper protection off first, then make your change. Turn tamper protection back on once you are finished.
Should I leave Tamper Protection on?
For most people, yes. Tamper protection helps prevent malicious apps from changing important Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection, and it is turned on by default for consumers. Turn it off only briefly if you must change a protected setting, then turn it back on.
What is the difference between a Quick scan and a Full scan?
A Quick scan is useful when you do not want to spend the time checking every file and folder. A Full scan is recommended if you think your PC is infected with malware, and your PC might run a little slower while it looks everywhere for possible problems.
When should I use the Microsoft Defender Offline scan?
Use it when you are concerned your device has been exposed to malware or a virus and ordinary scans have not resolved the issue. It runs after a restart without loading Windows, so persistent malware has a harder time hiding. Save open files first, since your PC restarts to complete the scan.
