A Defender Antivirus switch turning off does not, by itself, mean your PC has been attacked. A compatible third-party antivirus can turn Defender off automatically, and real-time protection that you turn off temporarily is designed to turn back on after a short while. Check which antivirus is active and review Windows Security’s threat records before deciding what the change means.
How can I tell if Windows Defender turned itself off?
Start by checking the active security provider rather than judging the Defender toggle alone. In Windows Security, open Virus & threat protection, then under Who’s protecting me? select Manage providers. This shows which antivirus is protecting the device. Microsoft’s Virus & threat protection guidance covers Windows 10 and Windows 11.
As an Amazon Associate I earn from qualifying purchases.
Then review Current threats and Protection history. Look for detections, quarantined items, or items that were previously allowed. A record of a threat merits attention, but it still does not establish that the Defender status change itself was caused by an attack.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Which status changes are expected, and which deserve investigation?
| What you find | What it may mean | What to do |
|---|---|---|
| A compatible third-party antivirus is listed as protecting the device | Microsoft says compatible non-Microsoft antivirus software automatically turns Microsoft Defender Antivirus off. | Confirm that the other product is active and up to date. If you uninstall it, verify afterward that Defender or another antivirus is active. |
| You deliberately turned off real-time protection and it later came back on | Microsoft says real-time protection automatically turns back on after a short while when temporarily disabled. | Confirm the current protection status. While real-time protection is off, files you open or download are not scanned in real time. |
| No known antivirus explains the change, protection stays off, or Windows Security records threats | This is unexplained and warrants further investigation. Malware may try to disable security software, but these signs alone do not prove malware caused the change. | Review Protection history, update security intelligence, and run a scan. Consider an offline scan if concerns persist. |
Microsoft documents the behavior of third-party antivirus and provider checks in its provider and antivirus guidance, and the automatic return of real-time protection in its real-time protection instructions.
#1 Best Overall
What to do if the change is unexplained
- Check the protection record. In Windows Security, go to Virus & threat protection and inspect Current threats and Protection history. Note detections, quarantined items, and anything you previously allowed.
- Update security intelligence. Open Virus & threat protection > Protection updates and check for updates before scanning. Microsoft’s Windows Security scan guidance recommends a full scan when unwanted software is suspected.
- Run a full scan. Use the scan options in Windows Security. A full scan is appropriate when you suspect unwanted software; it is not a guarantee that every possible problem has been ruled out.
- Use Microsoft Defender Offline if concern remains. Save open work first. The offline scan restarts the PC into Windows Recovery Environment and scans without loading Windows, which makes it harder for persistent malware to hide or defend itself. Review the result in Protection history.
- Scan a particular file or folder if needed. In File Explorer, right-click the item and choose the Microsoft Defender scan option. On Windows 11, it may be under Show more options.
What Tamper Protection can—and cannot—tell you
Tamper Protection helps prevent malicious apps from changing settings such as real-time protection and cloud-delivered protection. It is a safeguard, not proof that the device is clean: Microsoft warns that malware may try to disable security software, and no single Defender status screen can identify the cause of a particular change. See Microsoft’s Tamper Protection overview.
What not to do while troubleshooting
- Do not turn off Tamper Protection to try to force a setting change.
- Do not add broad exclusions as a general fix. Excluded files and folders are not checked by Defender in real time, which can leave the device vulnerable. An exclusion is appropriate only for a specific trusted item when there is a clear reason.
- Do not assume uninstalling an antivirus leaves Defender active immediately. Verify the active provider afterward. Microsoft also cautions that multiple antimalware products can cause slow performance, instability, or unexpected restarts.
For Microsoft’s guidance on malware response and antivirus conflicts, see help protect my PC with Microsoft Defender Antivirus.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Windows 10 support status
Microsoft says Windows 10 support ended on October 14, 2025. After that date, free software updates, technical assistance, and security fixes are no longer provided through Windows Update. See Microsoft’s Windows 10 support and troubleshooting information.
Recommended Free Tools
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
