You opened Windows Security expecting that green checkmark, and instead real-time protection is switched off again. Maybe it flips back off minutes after you toggle it on, or the switch is greyed out entirely and you cannot touch it. Before you assume your PC is broken or infected, know this: Microsoft Defender Antivirus is built to step aside under certain conditions, and most cases of it "turning off" are predictable and fixable. The fixes below are ordered easiest and safest first, so start at the top and stop as soon as protection holds.
Why Defender Steps Aside on Its Own
The single most common reason Defender turns off is not a bug at all. Microsoft states plainly: "If you install a compatible non-Microsoft antivirus program Microsoft Defender antivirus will automatically turn itself off." If you recently installed another security app, or one came preinstalled, or a trial activated quietly in the background, that is the expected behavior rather than a fault.
Windows does this on purpose because running two antivirus products at the same time causes conflicts. Microsoft warns it "can cause problems on your computer to have two different antimalware products installed and running at the same time." So before you change a single setting, ask yourself whether another security tool is present. If it is, the real fix lives further down in this guide, and Defender will return on its own once that product is gone.
There is also a normal, temporary case to rule out. If you turned real-time protection off manually, Microsoft notes the setting "will turn back on automatically after a short while to resume protecting your device." That brief pause is by design. A problem only exists when protection stays off permanently or refuses to enable.
Open the Windows Security App First
Everything that follows happens inside the Windows Security app, which is built into both Windows 10 and Windows 11. The quickest way in is to search for Windows Security in the Start menu and open it.
If you prefer the Settings route, the path differs by version. On Windows 11, go to Start > Settings > Privacy & security > Windows Security and select Open Windows Security. On Windows 10, the path is Start > Settings > Update & Security > Windows Security. Once the app is open, select Virus & threat protection to reach the screen where you manage protection and run scans.
Switch Real-Time Protection Back On
This is the most direct fix when the toggle is simply off and reachable. Inside Windows Security, head to the protection settings and flip the switch on.
- 1.Open Windows Security and select Virus & threat protection.
- 2.Under Virus & threat protection settings, select Manage settings.
- 3.Switch Real-time protection to On.
If you want to jump straight to this area, the shortcut windowsdefender://threatsettings/ opens the Manage settings screen directly. Keep an eye on the toggle after you set it. If it holds, you are done. If it flips off again on its own within a short time, that is normal recovery behavior; if it switches off and stays off, suspect a third-party antivirus or a policy, which the next steps address.
Turn On Tamper Protection So Nothing Flips It Back Off
Tamper Protection is your insurance against settings being changed behind your back. Microsoft describes it as a feature that "helps prevent malicious apps from changing important Microsoft Defender Antivirus settings," including real-time protection and cloud-delivered protection.
To enable it, go to Windows Security > Virus & threat protection > Manage settings and set Tamper protection to On. With this active, malware and rogue apps can no longer silently disable your antivirus.
One thing worth knowing so you do not mistake protection for a malfunction: when Tamper Protection is on, Microsoft notes "you'll need to turn it off before you can turn Real-time protection off." In other words, if a toggle seems stuck, that may be Tamper Protection doing exactly its job. That is a good sign, not a problem.
Remove a Conflicting Third-Party Antivirus
If the earlier check revealed another security product, and you want Defender to be your main protection, the supported fix is to uninstall that other product. Because Defender automatically disables itself whenever a compatible non-Microsoft antivirus is present, no toggle will override that while the rival app is installed.
Use Windows' normal app-uninstall process, or the vendor's own removal tool if they provide one, to remove the other antivirus completely. After it is gone, Microsoft confirms Defender "should return to active mode automatically." There is no need to manually re-enable it; Windows handles the handoff once the field is clear.
Resist the urge to keep both for "extra safety." Two antimalware products running together do not double your protection; they interfere with each other and can cause the very instability you are trying to fix.
When the Toggle Is Greyed Out and Managed
Sometimes the real-time protection switch is not just off, it is unavailable, and you may see a note that the setting is managed. On a work or school device, this usually means an organization controls it.
Microsoft notes that some pages or features of the Windows Security app might not be available, and that a system administrator may prevent you from turning real-time protection off or on. In that case, the documented path is to contact your IT administrator. Microsoft does not provide consumer registry edits or policy overrides to force the toggle open here, so reaching out to whoever manages the device is the correct and only supported step.
Scan for Malware That May Be Disabling Protection
Malware frequently tries to shut down antivirus software so it can operate undetected. If nothing above explains the behavior, run a thorough scan to rule out an active infection.
Start with a Full scan. In Windows Security, go to Virus & threat protection > Scan options, choose Full scan, and select Scan now. Microsoft describes this as a scan that "Scans every file and program on your device," so it is slower than a quick scan but far more thorough. You can also launch it with the shortcut windowsdefender://fullscan/.
If a Full scan comes back clean but protection still drops off, escalate to a Microsoft Defender Offline scan. This is the official offline scanner, and it is built to catch threats that hide while Windows is loaded. Microsoft explains it "happens after a restart, without loading Windows," which leaves persistent malware nowhere to hide. Save and close anything you are working on first, because the scan restarts your PC.
- 1.Save and close any open files, because your PC will restart.
- 2.In Windows Security, go to Virus & threat protection > Scan options.
- 3.Select Microsoft Defender Offline scan, then select Scan now.
The scan runs inside the Windows Recovery Environment, and your PC restarts again when it finishes. Afterward, check what it found in Windows Security > Protection history. You can also trigger this scan with the shortcut windowsdefender://wdoscan/.
Keep Windows Updated to Keep Security Healthy
An out-of-date system can leave Defender's components or definitions in a degraded state, which sometimes looks like protection dropping off. Keeping Windows current is part of keeping Windows Security itself healthy, and Windows is set to download and install available updates automatically unless you are on a metered connection.
Installing pending updates keeps Defender's parts and its security intelligence working as intended. If your protection seems to fade because of stale definitions, applying any waiting updates is a simple and low-risk way to restore it. Make this a habit rather than a one-time fix.
Frequently Asked Questions
Why does Microsoft Defender keep turning itself off after I turn it on?
The most common cause is a compatible non-Microsoft antivirus installed on your PC. Microsoft states that when such a program is present, Defender will automatically turn itself off. Remove the other antivirus and Defender should return to active mode automatically.
Is it normal for real-time protection to turn back on by itself?
Yes. Microsoft notes that real-time protection can only be turned off temporarily, and that it "will turn back on automatically after a short while to resume protecting your device." That automatic recovery is expected. A genuine problem only exists when protection stays off permanently or will not enable at all.
The real-time protection toggle is greyed out. How do I fix that?
If the toggle is unavailable and shows that the setting is managed, your device may be controlled by an organization. Microsoft notes a system administrator may prevent you from turning real-time protection on or off, and the documented step is to contact your IT administrator. No consumer override is provided for this case.
Should I run two antivirus programs for extra protection?
No. Microsoft warns that having two different antimalware products installed and running at the same time can cause problems on your computer. Choose one. If you want Defender as your main protection, uninstall the other product so Defender can return to active mode.
What is the difference between a Full scan and a Microsoft Defender Offline scan?
A Full scan "Scans every file and program on your device" while Windows is running. A Microsoft Defender Offline scan instead restarts your PC and runs before Windows loads, which catches malware that hides during normal operation. Use the offline scan when a Full scan comes back clean but protection still misbehaves.
