How Do I Fix Windows Defender Real-Time Protection Keeps Turning Off?

Issue type: Software — Windows Defender Real-Time Protection in Windows Security disables itself automatically, sometimes within minutes of being re-enabled or after every restart

SEO focus: If you are looking for windows defender real time protection keeps turning off, this guide starts with the fastest diagnosis, then moves to the exact fix that matches the symptom.

Short answer: Real-Time Protection turning itself off is never random — something is actively disabling it. The three possibilities are: a third-party antivirus is installed and Windows is correctly disabling Defender to avoid conflicts (the most common cause), malware on the system is disabling Defender to evade detection (the most serious cause), or a Group Policy is set to keep Defender off (common on work or school PCs). Identifying which one applies takes a minute.

Windows Defender Real Time Protection Keeps Turning Off: Quick Diagnosis

Establish what’s actually happening by checking three things in order:

Open Settings > Privacy & security > Windows Security > Virus & threat protection. Look at the top — does it say “Your virus & threat protection is managed by your organization” or list a third-party antivirus by name (Avast, Bitdefender, Norton, McAfee, etc.)? If so, Defender is being disabled by design. This is correct behavior, not a malfunction. Windows automatically disables Defender’s real-time protection when another antivirus product registers itself as the active security solution. The system can only have one real-time scanner active at a time.

If no third-party antivirus is named, check the Tamper Protection setting. In the same Virus & threat protection section, scroll down and click Manage settings. Look for Tamper Protection — it should be On. If it’s off and Real-Time Protection keeps disabling, malware may be actively turning off Defender as part of its self-preservation. Run a full offline scan immediately (see step 5).

If Tamper Protection is on but Real-Time Protection still won’t stay enabled, a Group Policy or registry entry is enforcing Defender to remain off. This is common on PCs joined to a corporate domain or after running aggressive “Windows debloater” scripts that disabled Defender via policy.

The status indicator color tells you the severity: yellow warning is informational (Defender is off but the system has another antivirus), red shield is critical (no antivirus protection active at all).

What to do first

1. Check whether you have a third-party antivirus installed. Open Settings > Apps > Installed apps and look for any antivirus software (Avast, AVG, Bitdefender, Norton, McAfee, Kaspersky, ESET, Webroot, etc.). If you find one and don’t actively use it, uninstall it. After uninstalling, restart Windows. Then go back to Windows Security > Virus & threat protection and Real-Time Protection should be available to enable and stay enabled. If you want to keep both Defender and the third-party antivirus, that’s not possible for real-time scanning — only one can be active at a time. Choose one.
2. Enable Tamper Protection to prevent unauthorized changes to Defender. Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings > toggle Tamper Protection on. Tamper Protection blocks apps from changing Defender’s settings via API calls or registry edits. Even malware that gains elevated privileges can’t disable Defender once Tamper Protection is active. After enabling, try turning Real-Time Protection on — it should now stay on.
3. Check for a Group Policy disabling Defender. Press Win + R, type gpedit.msc, and press Enter. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. Look at Turn off Microsoft Defender Antivirus. If the State shows “Enabled,” that’s why Defender keeps turning off. Set it to Not Configured or Disabled (yes, disabling the “Turn off Defender” policy enables Defender — the wording is double-negative). Click OK. Also check Real-Time Protection subfolder for “Turn off real-time protection” — same logic applies.
   Note: gpedit.msc is only available on Windows 11 Pro and above. On Home edition, you’ll need to check the registry instead — see the warning section.
4. Check the registry for Defender-disable entries that override the UI. Open Registry Editor (Win + R > regedit) and navigate to:
   HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender
   If you see a value named DisableAntiSpyware set to 1, that’s blocking Defender from staying on. Right-click it > Modify > change the value to 0, or delete the value entirely. Also check:
   HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows DefenderReal-Time Protection
   Look for DisableRealtimeMonitoring set to 1 — same fix.
5. Run a full Microsoft Defender Offline Scan to check for malware actively disabling Defender. Windows Security > Virus & threat protection > Scan options > select Microsoft Defender Offline scan > click Scan now. This restarts Windows into a recovery environment and scans for threats outside the normal Windows session — important because some malware can hide from in-OS scans by injecting into trusted processes. The scan takes 15-30 minutes and Windows restarts automatically when done. Review the results in the Protection history afterward.
6. Repair Windows Security app components via PowerShell. If Defender’s UI is malfunctioning even after policy and registry fixes, the Defender app package itself may be damaged. Open PowerShell as Administrator and run:
   Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
   This resets the Windows Security app without affecting Defender’s actual scanning engine. After it completes, restart Windows and try enabling Real-Time Protection again. If general system file corruption may also be involved, running sfc /scannow can repair underlying components that Defender relies on.

⚠️ Warning: Editing the registry to enable Defender requires the registry path described in step 4. Before making any changes, export the Windows Defender key first: right-click the key > Export, save the .reg file as a backup. If you set DisableAntiSpyware to 0 or delete it incorrectly, you can restore the backup by double-clicking the .reg file. Do not delete the entire Windows Defender key — only modify the specific values mentioned.

Common mistake

Trying to enable Real-Time Protection while a third-party antivirus is still installed and active. Windows correctly disables Defender’s real-time protection when another antivirus is registered as the system’s security solution — this prevents two real-time scanners from conflicting and slowing down the PC dramatically. Toggling Real-Time Protection on in this state shows the toggle briefly switching, then reverting. The behavior is correct, not a bug. To use Defender, you must uninstall the third-party antivirus first. Trying to fix the “Defender keeps turning off” symptom without addressing the third-party product is pointless — Windows will keep disabling Defender as long as another antivirus owns the security registration.

Best next step

If you’ve confirmed no third-party antivirus is installed, no Group Policy is set, the registry is clean, and Defender still won’t stay on, the Windows Security app or the Defender engine may be corrupted at a deeper level than the AppX package reset can fix. The most reliable repair is an in-place upgrade using the Media Creation Tool. Download “Windows 11 Installation Media” from Microsoft’s website, run the tool, and choose “Upgrade this PC now.” This reinstalls Windows over itself, repairing all system components including Defender, without removing your files, apps, or settings. The process takes 30-45 minutes and is significantly less destructive than a full Windows reset. After completion, Defender should be fully functional with Real-Time Protection staying on permanently. If you also need to address other security-related Windows components — for instance Settings showing the wrong info or feature toggles being broken — the in-place upgrade often fixes those simultaneously.

Official reference: For official Windows troubleshooting guidance, check Microsoft’s Windows support page before downloading third-party repair tools or changing advanced settings.

Quick Q&A

I uninstalled my antivirus a week ago but Windows still won’t enable Defender. Why?

Some third-party antivirus products leave behind registry entries that continue to register them as the active security solution even after the program files are removed. The uninstaller doesn’t always clean these up completely. Search for an official removal tool from your previous antivirus vendor — most major brands (Norton, McAfee, Avast, AVG, ESET, Bitdefender) publish standalone removal utilities that remove every trace including the registry entries. Run that tool, restart, and then check Windows Security. Defender should be available to enable.

Real-Time Protection turns off whenever I download certain files. Is that normal?

Defender doesn’t turn itself off when scanning a file — but it does briefly show as “snoozed” or “paused” if a specific scan is taking longer than usual. This appears as Real-Time Protection being off for a few seconds in some UI states. If the toggle shows as off for more than a minute after a download, something else is happening. Check whether the file you downloaded was an installer for an antivirus tool, a “Windows tweaker” utility, or a registry cleaner — these can disable Defender as part of their installation. The downloaded file itself may be the cause, not just a coincidence with the download.

My PC is from work and Real-Time Protection is grayed out completely. Can I enable it myself?

No — if the controls are grayed out and the page shows “Your virus & threat protection is managed by your organization,” your IT administrator has applied a policy that you cannot override locally. This is intentional. The organization is either using a different enterprise antivirus solution (which is why Defender is disabled), or they’ve set a specific configuration that prevents users from modifying security settings. Contact your IT department if you need clarification on what protection is active on the device — they can confirm whether you’re protected by a managed solution or whether Defender is genuinely disabled without a replacement.