Skip to content

Defender Status

Microsoft Defender Antivirus is built into Windows 11 and Server 2022 and on by default. An image will have turned it off, or turned off the part that matters.

Where to look

Windows Security (search for it, or Settings → Privacy & security → Windows Security). The home page shows each protection area with a green check, yellow warning, or red X. Start with anything not green.

The dashboard doesn't show everything, so read the values back with PowerShell.

Is the service running?

Get-Service WinDefend | Select Status, StartType
Get-MpComputerStatus | Select AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

AMServiceEnabled              : True
AntivirusEnabled              : True
RealTimeProtectionEnabled     : False
AntivirusSignatureLastUpdated : 3/14/2026 2:11:08 AM

Two problems: real-time protection is off, and signatures are months old.

Turn real-time protection on

Windows Security → Virus & threat protection → Manage settings → Real-time protection: On.

Set-MpPreference -DisableRealtimeMonitoring $false

If the toggle is greyed out or flips back off, a policy is forcing it. gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus:

  • Turn off Microsoft Defender Antivirus: Not Configured
  • Real-time Protection → Turn off real-time protection: Not Configured

Registry equivalents: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and ...\Real-Time Protection\DisableRealtimeMonitoring. Delete them if present.

Third-party antivirus

If another antivirus is installed, Defender turns itself off automatically. Two real-time scanners fight each other, so pick one. Usually that means uninstalling the third-party product (Settings → Apps) and letting Defender come back. Check the README first in case the scenario names an antivirus the company uses.

Update and scan

Update-MpSignature
Start-MpScan -ScanType QuickScan

Start a full scan in the background (-ScanType FullScan) and keep working on other things.

Verify

Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureAge

True, True, and an age of 0 or 1 days.

Try it

  1. Run Get-MpComputerStatus and read every line. Turn real-time protection off in the Settings app, run it again, turn it back on.
  2. Run a quick scan from PowerShell and find its result in the Protection history.

Build it

A defender.ps1 that prints the five status lines that matter (real-time, cloud, signatures age, last scan) and warns on any that's off.

Next

Defender Exclusions