Defender Status¶
Microsoft Defender Antivirus is built into Windows 11 and Server 2022 and on by default. An image will have turned it off, or turned off the part that matters.
Where to look¶
Windows Security (search for it, or Settings → Privacy & security → Windows Security). The home page shows each protection area with a green check, yellow warning, or red X. Start with anything not green.
The dashboard doesn't show everything, so read the values back with PowerShell.
Is the service running?¶
Get-Service WinDefend | Select Status, StartType
Get-MpComputerStatus | Select AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
AMServiceEnabled : True
AntivirusEnabled : True
RealTimeProtectionEnabled : False
AntivirusSignatureLastUpdated : 3/14/2026 2:11:08 AM
Two problems: real-time protection is off, and signatures are months old.
Turn real-time protection on¶
Windows Security → Virus & threat protection → Manage settings → Real-time protection: On.
Set-MpPreference -DisableRealtimeMonitoring $false
If the toggle is greyed out or flips back off, a policy is forcing it. gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus:
- Turn off Microsoft Defender Antivirus: Not Configured
- Real-time Protection → Turn off real-time protection: Not Configured
Registry equivalents: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and ...\Real-Time Protection\DisableRealtimeMonitoring. Delete them if present.
Third-party antivirus¶
If another antivirus is installed, Defender turns itself off automatically. Two real-time scanners fight each other, so pick one. Usually that means uninstalling the third-party product (Settings → Apps) and letting Defender come back. Check the README first in case the scenario names an antivirus the company uses.
Update and scan¶
Update-MpSignature
Start-MpScan -ScanType QuickScan
Start a full scan in the background (-ScanType FullScan) and keep working on other things.
Verify¶
Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureAge
True, True, and an age of 0 or 1 days.