Windows · Windows Server · high · Security, BitLocker & identity

Microsoft Defender will not turn on

Defender steps aside for a third-party product, and is left disabled when that product is removed badly. A policy or malware can do the same deliberately.

What you see

"Your virus & threat protection is managed by your organisation" on a machine with no organisation, or the real-time protection toggle greyed out and off.

What is actually wrong

Leftover registry policy from an uninstalled antivirus, a stale WMI registration for a security product that is gone, or a policy set by malware to keep itself safe.

Codes and articles

Defender turned off by policy0x800106baDisableAntiSpywareThreat service has stopped

Fixes (2)

Remove the previous product's registration completely

Elevated PowerShell30 minutesmedium riskreversible

Another antivirus has been installed and removed.

See what the Security Centre still believes is installed.
PowerShell
```
Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Format-List displayName,productState,pathToSignedProductExe
```
Defender stands down while another product is registered here. If the old product is listed but no longer installed, Defender will stay off no matter what is clicked in Settings.
Run the vendor's own removal tool. Every major antivirus publishes one, and it removes the filter drivers and registrations a normal uninstall leaves behind.
Restart, then check the registration list again — the stale entry should be gone.

Start Defender's services.

PowerShell

Set-Service WinDefend -StartupType Automatic -ErrorAction SilentlyContinueStart-Service WinDefendStart-Service SecurityHealthService

Update the definitions, which will be months old.
PowerShell
```
Update-MpSignature
```

Confirm it workedReal-time protection is on and the definitions are current.

PowerShell

Get-MpComputerStatus | Format-List AMServiceEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,AMRunningMode

If you need to undo itReinstalling the third-party product restores its registration.

Find and remove the policy holding it off

Elevated PowerShell30 minuteshigh riskreversible

No other antivirus was involved. Treat a machine that disabled its own antivirus as potentially compromised.

Look at the policy keys.

PowerShell

Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -ErrorAction SilentlyContinueGet-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -ErrorAction SilentlyContinue

If DisableAntiSpyware or DisableRealtimeMonitoring is set to 1 on a machine with no management, that is a strong indication something set it deliberately.
Disabling the antivirus by policy is one of the first things a lot of malware does. Turning it back on without investigating means it will simply be turned off again, or worse, will now be scanning a machine that is already compromised.
Scan from outside the running system before re-enabling — the Microsoft Defender Offline scan boots into its own environment.
PowerShell
```
Start-MpWDOScan
```

Remove the policy values.

PowerShell

Remove-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -ErrorAction SilentlyContinueRemove-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableRealtimeMonitoring -ErrorAction SilentlyContinuegpupdate /force

Restart, confirm protection is on, and run a full scan.
PowerShell
```
Start-MpScan -ScanType FullScan
```

Confirm it workedGet-MpComputerStatus reports real-time protection enabled and a completed full scan.

PowerShell

Get-MpComputerStatus | Format-List RealTimeProtectionEnabled,FullScanEndTime,AntispywareEnabled

If you need to undo itThe policy values can be recreated, though on a managed machine they should be set by Group Policy rather than by hand.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.