How to Fix Windows Defender Service Not Found in Windows

To troubleshoot “Windows Defender service not found,” first check whether another antivirus is installed, whether Windows Security says the setting is managed, and whether the Defender service appears in services.msc. Skipping those checks can lead you to change the wrong setting, leave protection off, or keep fighting a policy that comes back after the next sync or restart. This guide shows how to verify the service, read policy settings, remove conflicting antivirus, and then move to registry or system-file repair if needed.

What the error means and what to check first

This error usually means Windows cannot find the Defender service entry it expects. Start by checking whether the PC is managed, then whether a third-party antivirus is installed, and then whether the Defender service appears in services.msc. If SecurityHealthService exists but the Windows Security app is broken or hidden, that needs a different fix path.

Start with the safest triage

1. Open Settings > Apps > Installed apps and look for another antivirus.
2. Open services.msc and search for WinDefend and SecurityHealthService.
3. Open Windows Security > Virus & threat protection and note whether the page opens normally.
4. If the PC belongs to work or school, stop and ask IT before changing policy or registry settings.

Likely causes, from most to least common

• Third-party antivirus is installed and has changed Defender behavior.
• Group Policy or Intune is controlling Defender on a managed device.
• Policy keys under the Defender registry path disable the service on a home PC.
• File corruption affects Windows security components.
• Malware or a bad cleanup tool removed service entries or changed security settings.

Say your laptop is a 256 GB home PC and the Windows Security page opens, but WinDefend is absent from Services. That points away from a simple “turn it on” problem and toward policy, security software conflict, or damaged entries. The decision tree below separates those cases before you touch repair tools.

How do I check services.msc and Windows Security?

Open services.msc and confirm whether WinDefend appears at all; if it does, note whether it is Running, Disabled, or missing. Then open Windows Security > Virus & threat protection and verify whether the interface loads. Also check SecurityHealthService, because a broken health service can make the Windows Security app look empty even when Defender still exists.

Use these exact checks

1. Press Win + R, type services.msc, and press Enter.
2. Find WinDefend and SecurityHealthService.
3. Double-click each one and read Service status and Startup type.
4. Open Windows Security from Start and select Virus & threat protection.
5. If the page says an administrator controls the setting, policy is a likely cause on a managed PC.

When SecurityHealthService is stopped or disabled, the Windows Security app may fail to show normal status pages even if Defender is still installed. That is separate from a missing WinDefend service, so do not jump to registry repair until you know which one is absent.

What should the decision matrix look like?

Use the matrix below to match the symptom to the safest next move. On home PCs, you can inspect policy keys and try repairing Windows files. On managed PCs, stop at the policy checks and contact IT, since local changes may be overwritten by Group Policy or Intune.

What is most likely causing the problem?

The most common first conflict is another antivirus product. On managed devices, the next most likely cause is a policy from Group Policy or Intune. On home PCs, policy keys under the Defender path and file corruption are the next places to check before any registry rebuild or system repair.

Third-party antivirus conflict

1. Open Settings > Apps > Installed apps.
2. Uninstall any non-Microsoft antivirus you find.
3. Reboot Windows.
4. Reopen services.msc and check whether WinDefend returns.
5. If you need the third-party product, reinstall it only after Defender is verified.

Group Policy or Intune on a managed PC

1. Open Settings > Accounts > Access work or school.
2. Check whether the device is connected to an organization.
3. If it is managed, stop and contact IT.
4. Do not edit local policy or registry values past Intune-controlled settings.

Suppose a company laptop shows “This setting is managed by your organization” and the Defender service is absent after a reboot. That is a policy case first, not a repair case. Local fixes may vanish at the next sync, and IT may need to change the policy that removed the service entry.

How do I inspect Defender policy settings on a home PC?

On a home PC, open Registry Editor as administrator and inspect HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. If you find policy values there, back up the key before changing anything. That path is the clearest place to confirm policy-based disablement when Windows Security says the administrator controls the setting. (Microsoft Learn)

Check the policy path safely

1. Press Win + R, type regedit, and press Enter.
2. Approve the UAC prompt.
3. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender.
4. Back up the key by selecting it and using File > Export.
5. Look for policy values that disable Defender or its components.
6. If you are unsure what a value does, stop and record it before changing anything.

What to do next if policy values are present

1. On a home PC, remove only changes you can document and restore later.
2. Reboot Windows.
3. Recheck services.msc for WinDefend.
4. Open Windows Security > Virus & threat protection again.

What commands repair corrupted Windows files?

If the service exists but will not start, or Windows Security still misbehaves after policy checks, use Windows file repair next. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an elevated Command Prompt. A common approach is to run SFC first, then DISM, then restart and check the service again.

Run the repair commands in order

1. Open Start, type cmd, and choose Run as administrator.
2. Run sfc /scannow.
3. Wait for the scan to finish.
4. Run DISM /Online /Cleanup-Image /RestoreHealth.
5. Restart Windows.
6. Check services.msc and Windows Security again.

When a registry restore file comes up

Some replies mention a windefend.reg file or a default Windows Defender registry restore file. Treat that as a last-resort recovery method only when the file comes from a trusted Microsoft or IT source. The file must be merged into the system registry, and the PC must restart afterward.

Still not working?

If WinDefend still does not return, the next step is the more invasive path: repair the Windows image, restore security component entries only from a trusted source, or have IT rebuild the policy on managed hardware. Malware cleanup may also be needed if security entries were removed or altered.

If the service exists but will not start

1. Confirm WinDefend is set to its default startup state.
2. Re-run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth.
3. Restart Windows and test again.

If malware may have removed entries

1. Open Windows Security > Virus & threat protection.
2. Run a Microsoft Defender Antivirus (offline scan) if the option is available.
3. After the scan, restart and verify the service list again.

Prevention

Keep only one antivirus product active at a time on a home PC, and avoid policy tools you do not control. That reduces the chance that Defender is disabled, hidden, or overwritten after the next reboot.

Frequently asked questions

How do I fix Windows Defender service not found?

Check services.msc for WinDefend, verify SecurityHealthService, and uninstall any third-party antivirus before deeper repair work. If the device is managed, stop and contact IT. On a home PC, inspect HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, then run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth.

Why is Windows Defender service missing from Services?

Most often, another antivirus or a policy setting is involved. A home PC can be checked in services.msc and regedit. On an organization-owned device, Group Policy or Intune may be controlling Defender, so local edits may not stick.

Can I restore the WinDefend service in Windows 10?

Sometimes, yes, if the issue is policy or file corruption rather than a removed system component. Start with sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth. If a trusted Microsoft or IT registry file is supplied, merge it into the registry and restart.

What if Windows Defender is hidden by another antivirus?

Remove the third-party antivirus from Settings > Apps > Installed apps, reboot Windows, and check services.msc again. Another antivirus can cause Windows Security to disappear or look incomplete, so this is the first conflict worth ruling out on a home PC.

How do I check whether Group Policy is disabling Defender?

Open regedit and inspect HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. If the device is joined to work or school, also check Settings > Accounts > Access work or school. If it is managed, do not try to override the setting locally; contact IT.

What commands repair corrupted Defender files?

Run sfc /scannow first, then DISM /Online /Cleanup-Image /RestoreHealth from an elevated Command Prompt. After both finish, restart Windows and check services.msc plus Windows Security > Virus & threat protection. That sequence is the standard repair path when Windows components are damaged.