Microsoft Defender Turned Itself Off? Third-Party Antivirus Conflicts Explained
You open Windows Security and see:
Microsoft Defender Antivirus is turned off.
Perhaps the Real-time protection switch is unavailable.
Maybe Windows says:
Another antivirus provider is managing this device.
Or perhaps Defender seems to switch itself off again after every restart.
That can look worrying.
But it does not automatically mean malware has disabled your antivirus.
On Windows 11, Microsoft Defender Antivirus is designed to step aside when a compatible third-party antivirus registers itself as the active protection provider. Microsoft specifically warns against running multiple full real-time antivirus products simultaneously because doing so can cause instability and performance problems.
The important question is therefore not:
“Why is Defender off?”
It is:
“Which antivirus is protecting this PC right now, and is it actually healthy?”
Windows Security and Microsoft Defender Antivirus Are Different Things
The terminology is confusing.
Windows Security is the Windows application that displays the status of several security features.
That can include:
- antivirus
- firewall
- account protection
- app and browser controls
- device security
- security providers
Microsoft Defender Antivirus is the actual built-in antimalware engine.
Windows Security can remain installed and visible even when another antivirus product is providing the real-time protection. Microsoft explicitly says that disabling or replacing Defender Antivirus does not mean the Windows Security application itself disappears.
So seeing the Windows Security shield icon does not prove Defender Antivirus is the active antivirus engine.
Why Defender Turns Itself Off
When a compatible third-party antivirus product installs, it normally registers with Windows Security Center.
Windows recognises that another antivirus is protecting the device and Microsoft Defender Antivirus steps aside.
On an ordinary Windows 10 or Windows 11 PC without Microsoft Defender for Endpoint onboarding, Microsoft says the normal result is:
Microsoft Defender primary → Active mode
or:
Third-party antivirus primary → Defender disabled automatically.
That behaviour is intentional.
Running two complete real-time antivirus engines can cause:
- duplicate file scanning
- high CPU usage
- excessive disk activity
- conflicting detections
- installation failures
- application instability
Microsoft explicitly recommends choosing one real-time antivirus product rather than running several at once.
First: Check Who Is Actually Protecting the PC
Open:
Windows Security > Virus & threat protection
Under:
Who's protecting me?
select:
Manage providers
You can also open:
Windows Security > Settings > Manage providers
Windows should show which antivirus product is registered and whether it is active. Microsoft recommends this as the correct way to identify the current protection provider.
You may see something like:
Microsoft Defender Antivirus — On
or:
Third-party antivirus — On
Microsoft Defender Antivirus — Off
If the third-party product is active and healthy, Defender being off is usually normal.
Do Not Judge Antivirus Status by the Tray Icon
A third-party security application may still display its icon even if:
- its licence expired
- its service stopped
- its engine failed
- it is no longer registered correctly
Likewise, the Windows Security shield icon does not mean Defender Antivirus is necessarily the active provider.
Use:
Manage providers
and, on managed devices, the relevant endpoint-management console.
The question is not whether an icon exists.
The question is whether the antivirus engine is actually running and current.
Check Defender With PowerShell
For a technical view, open PowerShell and run:
Get-MpComputerStatus
A more focused result is:
Get-MpComputerStatus |
Select-Object AMRunningMode,
AMServiceEnabled,
AntivirusEnabled,
RealTimeProtectionEnabled,
IsTamperProtected,
AntivirusSignatureLastUpdated
The most useful field is:
AMRunningMode
Microsoft documents several possible modes.
Normal
Microsoft Defender Antivirus is the primary antivirus.
It is providing normal real-time protection and threat remediation.
Passive
Defender is present but is not the primary antivirus.
This is where the nuance matters.
Microsoft says passive mode is available only on endpoints onboarded to Microsoft Defender for Endpoint and meeting the required conditions.
So on an ordinary home or unmanaged business PC with a third-party antivirus, you should not assume Defender will simply sit in passive mode.
It may be disabled instead.
EDR Block Mode
This is principally a managed business scenario using Microsoft Defender for Endpoint.
Defender's EDR capabilities can provide additional remediation behind another primary antivirus, but Microsoft is clear that EDR block mode does not provide every protection capability available when Defender Antivirus itself is active.
Disabled / Not Running
Defender is not providing antivirus scanning.
This can be completely expected if another working antivirus is registered.
It becomes a concern when:
Defender is off + no other antivirus is genuinely protecting the machine.
Passive Mode Is Not “Two Full Antivirus Products”
This is another common misunderstanding.
If a managed business device has:
third-party antivirus + Defender passive mode
that does not mean two complete real-time antivirus products are independently scanning every file.
Microsoft says Defender in passive mode:
- is not the primary antivirus
- does not provide normal real-time remediation
- continues to support parts of the Defender for Endpoint security stack.
This is an intentional coexistence model.
It is different from simply installing two consumer antivirus products and hoping for extra protection.
What Is Limited Periodic Scanning?
Windows may offer Limited periodic scanning while another antivirus product is active.
This lets a limited portion of Microsoft Defender Antivirus occasionally scan the device.
But it should not be confused with full Defender protection.
Microsoft says limited periodic scanning:
- uses only a subset of Defender Antivirus capabilities
- cannot detect most malware in the way the full product does
- has limited reporting
- cannot be centrally managed in the same way
- is not supported for enterprise use.
Microsoft recommends that enterprise organisations choose one antivirus product and use that as their primary solution.
What Happens If You Uninstall the Third-Party Antivirus?
On Windows 11, Microsoft Defender Antivirus should normally re-enable automatically once the competing antivirus is removed.
Microsoft explicitly says that when a non-Microsoft antivirus product is uninstalled, Defender should return to active mode automatically.
After uninstalling:
- Restart Windows.
- Open Windows Security.
- Check Manage providers.
- Confirm Microsoft Defender Antivirus is active.
You can also run:
Get-MpComputerStatus |
Select-Object AMRunningMode,
AntivirusEnabled,
RealTimeProtectionEnabled
You would normally expect something consistent with:
Normal / True / True
once Defender has resumed responsibility.
If Defender Does Not Come Back
This is when troubleshooting becomes appropriate.
Possible causes include:
- remnants of old antivirus software
- incomplete uninstall
- damaged Windows Security registration
- Group Policy
- Intune policy
- security software migration configuration
- malware
- damaged Windows components
Do not immediately start modifying Windows Defender services manually.
Microsoft specifically warns against manually changing the start type of Defender services and drivers on Windows clients. The supported mechanism is for security products to register properly with Windows Security Center.
Remove Old Antivirus Properly
A normal uninstall may sometimes leave behind:
- drivers
- services
- filter components
- registration information
If the previous antivirus does not uninstall cleanly:
- Use Settings > Apps > Installed apps.
- Restart.
- Use the vendor's official cleanup/removal tool where necessary.
- Restart again.
- Check Windows Security.
Microsoft itself notes that some security software may not completely uninstall through the normal application removal process and recommends using the publisher's own support/removal process where necessary.
Avoid random “antivirus removal tools” from third-party download sites.
Don't Install Another Antivirus Just to Test Defender
This can make the situation worse.
If Defender is not working correctly, the answer is not:
install product B over product A to see what happens.
You may end up with:
- leftover drivers
- competing services
- conflicting file filters
- confusing Windows Security registration
Establish which product you actually want to use.
Then remove the others properly.
Tamper Protection Matters
Microsoft Defender includes Tamper Protection, designed to prevent unauthorised changes to key security settings.
Microsoft specifically recommends keeping it enabled because malware often attempts to disable security protections.
Check:
Windows Security > Virus & threat protection > Manage settings
Look for:
Tamper Protection
On business devices, the setting may be centrally controlled.
Do not disable it merely because an internet guide says doing so will make a Defender command work.
Defender Off With No Other Antivirus Is Different
This is the situation that deserves immediate attention.
If:
- Microsoft Defender is disabled
- no third-party antivirus is active
- Windows Security shows no healthy provider
then the device may currently have no working real-time antimalware protection.
Microsoft explicitly warns that disabling Defender without another active security product leaves the device vulnerable.
At that point:
- Disconnect from unnecessary network activity if compromise is suspected.
- Check Windows Security providers.
- Confirm whether security software recently changed.
- Re-enable Defender if possible.
- Investigate why protection disappeared.
When Malware Is a Possibility
Malware does sometimes try to interfere with security tools.
Become more suspicious if Defender turning off coincides with:
- unknown processes
- pop-ups
- browser redirects
- administrator accounts you did not create
- security settings repeatedly changing
- Tamper Protection unexpectedly disabled
- unusual network activity
On a device that still has working Microsoft Defender Antivirus, you can use a deeper scan such as Microsoft Defender Offline where appropriate.
Microsoft also provides Microsoft Safety Scanner as an on-demand scanner that can coexist with an installed real-time antivirus because it runs only when explicitly invoked.
Business PCs Need More Care
A company-managed endpoint may use:
- Microsoft Defender for Endpoint
- Defender for Business
- third-party EDR
- third-party antivirus
- Intune
- Group Policy
The visible Defender Antivirus state is therefore only one part of the security picture.
For example, a device might intentionally use:
third-party antivirus
while:
Microsoft Defender for Endpoint EDR
continues operating.
That is a supported enterprise architecture when configured correctly.
Do not try to force Defender into active mode on a managed company device unless you know the intended endpoint-security design.
You may create conflicts with the organisation's primary antivirus.
Defender for Endpoint Changes the Picture
This is the main business distinction.
On Defender for Endpoint-onboarded devices, Microsoft Defender Antivirus may remain available in passive mode behind another antivirus provider.
Microsoft says those devices can continue receiving Defender platform and security intelligence updates even when Defender Antivirus is not the primary engine.
That allows Microsoft’s broader endpoint-detection platform to continue functioning.
So on a managed device:
“Defender Antivirus is not primary”
does not necessarily mean:
“Microsoft security is inactive.”
You need to look at the complete endpoint-security configuration.
Do Not Disable Windows Security
Another bad internet fix is disabling the Windows Security app because another antivirus is installed.
Do not do that.
Microsoft explicitly warns that disabling the Windows Security app can:
- cause stale or inaccurate provider status
- interfere with Defender reactivating after third-party AV removal
- significantly reduce protection.
Leave Windows Security available.
It is the place Windows uses to report the security providers protecting the device.
The Fast Troubleshooting Order
If Microsoft Defender appears to have turned itself off:
- Open Windows Security.
- Go to Virus & threat protection > Manage providers.
- Identify the active antivirus.
- If a healthy third-party product is active, Defender being off is usually expected.
- If necessary, run:
Get-MpComputerStatus
- Understand that passive mode is mainly for Defender for Endpoint-onboarded devices.
- Do not run two ordinary real-time antivirus products together.
- If replacing third-party AV with Defender, uninstall the old product properly.
- Restart and confirm Defender becomes active.
- Use the vendor's official cleanup utility if old components remain.
- Keep Tamper Protection enabled.
- If no antivirus provider is active, treat it as a security problem.
- On managed business PCs, check Intune/Group Policy/endpoint-security policy before changing anything.
The key principle is:
Defender being off is not the problem if another healthy antivirus has intentionally taken over. Having no working antivirus at all is the problem.
How Hamilton Group Can Help
Hamilton Group can help businesses work out whether Microsoft Defender has legitimately stepped aside or whether endpoint protection has actually failed.
We can assist with:
- Microsoft Defender Antivirus
- Microsoft Defender for Business
- Microsoft Defender for Endpoint
- third-party antivirus migrations
- endpoint detection and response
- Microsoft Intune
- Windows Security
- Tamper Protection
- antivirus conflicts
- cyber-security monitoring
For managed environments, we can also verify that every device has exactly one intended primary antivirus and that the wider EDR/security stack is reporting correctly.
Visit hgmssp.com or call 0330 043 0069.