Windows Defender Antivirus Service Missing

If “Windows Defender Antivirus Service” is missing, check two things first: whether a third-party antivirus is installed and whether the device is managed by policy. If either applies, Defender can be hidden or disabled by design. This means WinDefend is not showing in services.msc. Skip that check, and you can waste time on fixes that will not stick and may break security settings. This guide shows how to tell a missing service from a policy block or AV suppression before you try fixes.

What the missing service usually means

The name you are looking for is WinDefend, the main Microsoft Defender Antivirus service. A missing entry in services.msc does not always mean the whole security stack is gone. (Microsoft Learn)

Check the nearby security services too. Security Health Service should show a running status, and Security Center should still be present for status reporting. Microsoft Defender Antivirus Network Inspection Service is a related component and may appear disabled or missing alongside other Defender pieces.

Defender service matrix

What is most likely to be behind it?

Most often, the cause is one of four things: another antivirus has taken over, a work or school policy is controlling Defender, Windows security files are damaged, or the Windows Security interface is hiding the real state. Malware and registry changes are less common, but they stay on the list when settings change without a clear reason.

Say your laptop shows Norton in the tray and Windows Security now says antivirus protection is off. That pattern usually points to automatic Defender suppression, not a broken service. Compare that with a home PC that suddenly has no WinDefend entry and no third-party antivirus; that case pushes you toward policy checks and file repair.

If the Windows Security app opens, but the status page is blank or says protection is unavailable, the service may still exist but be stopped, or the reporting components may be out of sync. Start by checking the support services before you chase deeper repairs.

Can another antivirus disable Windows Defender automatically?

Yes. A separate antivirus suite can turn Defender off automatically so two real-time scanners do not fight each other. That is commonly reported behavior for products such as Norton, McAfee, Bitdefender, Kaspersky, Avast, AVG, and ESET. In that case, the missing or disabled Defender entry is usually a side effect, not a malware sign. (Microsoft Learn)

1. Open Settings > Apps > Installed apps and look for another antivirus product.
2. Open Windows Security > Virus & threat protection and confirm whether another provider is listed.
3. If a third-party antivirus is active, uninstall it from Settings > Apps > Installed apps, then restart the PC.
4. After restart, open services.msc and check WinDefend, Security Health Service, and Security Center.
5. If WinDefend is still absent, move to Windows repair instead of repeating the uninstall.

Could Group policy or Intune be hiding Defender?

Yes. On managed devices, Group Policy and Intune can disable Microsoft Defender Antivirus or hide parts of its UI. That matters because a local repair may look successful for a moment and then revert after the next policy refresh. This is common on organization-owned PCs, not on personal devices.

1. Open Settings > Accounts > Access work or school and check for a connected organization.
2. Press Windows key + R, type gpedit.msc, and review Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Check the registry path HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for active policy values.
4. If the device is managed, ask the admin to review the policy in Intune or Group Policy instead of forcing local changes.

How do I restore Microsoft Defender Antivirus service?

If policy and third-party antivirus do not explain the issue, repair the Windows security stack before trying a service restore. A downloaded registry file should only be used if Microsoft support has provided it for your specific case and only after you have ruled out policy management and competing antivirus software. A bad registry merge on a managed PC can create a bigger mess.

1. Open services.msc and check whether WinDefend, Security Health Service, and Security Center exist.
2. If WinDefend is present but stopped, set it to start normally and then start the service.
3. If the service entry is missing and the PC is unmanaged, repair Windows files first with sfc /scannow.
4. Then run DISM /Online /Cleanup-Image /RestoreHealth from an elevated Command Prompt.
5. Reboot, then recheck services.msc and Windows Security.
6. If a trusted repair package from Microsoft support is available for your case, use it only after the scans finish and no policy block is found.

Do SFC and DISM fix missing Defender components?

Sometimes. sfc /scannow repairs protected system files, and DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows image that SFC depends on. Those commands help when security services fail to load, disappear after corruption, or break after an update. They do not typically override Group Policy or Intune.

1. Open Command Prompt as administrator.
2. Run sfc /scannow and wait for it to finish.
3. If SFC reports problems it could not repair, run DISM /Online /Cleanup-Image /RestoreHealth.
4. Restart the PC after DISM completes.
5. Open services.msc and check WinDefend, Security Health Service, and Security Center again.

How do I tell if Defender is disabled by policy or malware?

Policy blocks usually line up with a managed device, a visible organization account, or a registry path under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. Malware-related changes are more suspicious when the same device also has broken services, unexplained security UI changes, or a missing Defender entry with no installed antivirus and no management enrollment.

1. Check whether the device is joined to a work or school tenant in Settings > Accounts > Access work or school.
2. Open services.msc and verify whether Security Health Service and Security Center are running.
3. Check Windows Security > Virus & threat protection for another antivirus provider.
4. If no policy or AV explains the change, run sfc /scannow and then DISM /Online /Cleanup-Image /RestoreHealth.

Still not working?

If WinDefend still does not appear after policy checks, antivirus removal, and system repair, the next step is a broader Windows repair path or admin support. On a managed device, stop local troubleshooting and escalate to the organization’s IT team. On a personal PC, consider an in-place repair install of Windows before a reset.

1. Recheck Windows Security after every restart so you know which change mattered.
2. If the service returns and then disappears again, look for policy enforcement or a security suite reinstall.
3. If the service never returns, collect the output from sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth for support.
4. For a work or school PC, send the issue to the admin instead of changing device policy locally.

Keep only one real-time antivirus active unless your organization says otherwise. Defender and a third-party suite can keep replacing each other’s status after every reboot.

Frequently asked questions

What is Microsoft Defender antivirus service?

It is the Windows service commonly called WinDefend. It handles Microsoft Defender Antivirus protection, including real-time scanning and status reporting. If it is absent, check whether another antivirus is installed, whether the PC is managed, and whether Windows security components still show up in services.msc.

Why is Windows Defender Antivirus turned off?

The usual reasons are another antivirus taking over, a policy setting from Group Policy or Intune, or a damaged Windows security component. Check Windows Security > Virus & threat protection, then open services.msc and verify WinDefend and Security Health Service.

Why is the WinDefend service missing from services.msc?

It may be hidden by policy, disabled by another antivirus, or damaged by system corruption. Start with the registry path HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, then run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth if the device is not managed.

Which Defender-related services should be running?

At minimum, check WinDefend, Security Health Service, and Security Center. Use services.msc to confirm their status after any change.

Could Group policy or Intune hide microsoft Defender?

Yes. Managed devices can hide or disable Defender through Group Policy or Intune. Check Settings > Accounts > Access work or school and the registry path HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. If the PC belongs to an organization, ask the admin to change the policy.

Is Microsoft Defender Antivirus Network Inspection Service related to this issue?

Yes, it is a related Defender component and may appear disabled or missing alongside other security services. It is not the first thing to fix. Check WinDefend, Security Health Service, and Security Center first, then review the network inspection service if the rest of the stack is still inconsistent.