Windows Defender Has Stopped Working

Windows Defender has stopped working because the Windows Security app, the Defender service, or security intelligence is broken. Restart first, then check the Windows Security app, the WinDefend service, and Defender definitions in that order. If you ignore it, real-time protection can stay off and malware or a disabled service may go unnoticed. This guide helps you identify which layer failed and fix the least invasive one first.

Quick Answer

This usually points to one of three layers: the Windows Security app that opens the interface, the Microsoft Defender Antivirus service named WinDefend, or the security intelligence and engine files used for scanning. A blank page, a stopped service, and a failed offline scan do not call for the same fix.

Start by matching the symptom to the layer before changing settings. If Windows Security opens to a white page but the service still shows as running, the app package is a likely cause. That points to the app package. Suppose the UI opens, but protection says unavailable. That points more toward WinDefend or definitions.

Windows Defender triage table

Why won’t Windows Security open?

A blank or unopened Windows Security window usually means the app package is damaged, but policy issues or broader system corruption can produce the same symptom. The least invasive fix is to reset the Windows Security app package before moving to image repair or registry checks.

1. Open Terminal (Admin).
2. Run Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage.
3. Open Windows Security again and check whether the home page loads.
4. If it still opens to a blank screen, open Command Prompt (Admin) and run DISM /Online /Cleanup-Image /RestoreHealth.
5. After DISM finishes, run sfc /scannow.

Check SecurityHealthService only as a version-aware follow-up. Its service key lives under HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService, and the Start DWORD value should be 3 on builds where that setting is used. Treat that as a check, not a first move.

Why is WinDefend stopped?

WinDefend is the Microsoft Defender Antivirus service, and service state can be affected by policy, a different antivirus package, or system damage. Use elevated PowerShell to check the service instead of guessing from the UI. That tells you whether the problem is real service failure or only a broken front end.

1. Open PowerShell (Admin).
2. Run Get-Service WinDefend.
3. Read the output fields: DisplayName, Name, StartType, and Status.
4. If another antivirus is installed, uninstall it and restart the PC.
5. Run Get-Service WinDefend again after the restart.

Microsoft Defender can conflict with third-party antivirus software. If that software is active, remove it first and reboot before changing Defender settings. A service that looks wrong before the reboot may return to normal afterward.

How do you repair Defender definitions?

If the service exists but scans or protection still fail, the engine or definitions may be damaged. The Defender platform folder under %ProgramData%\Microsoft\Windows Defender\Platform holds versioned subfolders. Use the current platform path and the built-in command-line tool to clear and refresh the signatures.

1. Open File Explorer and go to %ProgramData%\Microsoft\Windows Defender\Platform.
2. Open the newest versioned folder inside Platform.
3. Run MpCmdRun.exe -RemoveDefinitions -All.
4. Then run MpCmdRun.exe -SignatureUpdate -MMPC.
5. Reopen Windows Security and confirm that protection information updates.

This is the right branch when Defender is present but definitions look stale or refuse to refresh. If the command fails, move back to DISM and SFC, because file corruption can block the update path.

Why did Defender break after a reset or cleanup?

After a reset, cleanup, or removal tool, Windows components can lose files or registrations that Defender depends on. In that case, repair the Windows image first, then replace damaged system files. That order avoids repeated app resets that cannot fix the underlying corruption.

1. Open Command Prompt (Admin).
2. Run DISM /Online /Cleanup-Image /RestoreHealth.
3. Wait for DISM to finish without closing the window.
4. Run sfc /scannow.
5. Restart the PC and test Windows Security again.

If the issue started right after a PC reset, a blank screen or disabled service often points to missing Windows components rather than a pure Defender problem. If the same symptom remains after both commands, return to the app reset and service check instead of repeating the same repair.

What if Microsoft Defender stopped working after malware removal?

Removal tools can leave behind broken services, policy entries, or damaged security app files. That makes this a different case from a routine update failure. Start with the service check, then repair the UI and Windows image if the failure began right after cleanup.

1. Open PowerShell (Admin) and run Get-Service WinDefend.
2. Open Terminal (Admin) and run Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage.
3. Open Command Prompt (Admin) and run DISM /Online /Cleanup-Image /RestoreHealth.
4. Run sfc /scannow after DISM completes.
5. Update definitions with MpCmdRun.exe -SignatureUpdate -MMPC if the service returns but protection still looks stale.

A common first-timer mistake is to keep reinstalling security apps instead of checking whether Windows Defender services are disabled. That can leave you with a half-repaired security stack and a harder recovery path.

Why is Windows Defender offline scan not working?

An offline scan failure is not always a Defender engine problem. BitLocker, boot configuration, and local environment restrictions can stop the scan before it starts. That is why offline scan errors need a different check list from a blank app window or a stopped service.

1. Open Windows Security and go to Virus & threat protection.
2. Choose Scan options and select Microsoft Defender Offline scan again.
3. If it fails, note the exact error text and whether BitLocker is enabled.
4. Confirm the PC can restart into the recovery path required for the scan.
5. If the failure repeats, repair the system image with DISM and SFC before trying again.

Suppose the device is encrypted with BitLocker and the offline scan stops immediately after restart. That points away from the Defender UI and toward boot or policy limits that must be cleared first.

Still not working?

If the service check, app reset, definition refresh, and image repair all fail, the next step is escalation. Capture the exact command that failed, the message shown, and whether the problem started after a PC reset or malware removal. Event ID 5008 can indicate an antimalware engine failure, which is useful detail for support.

At that point, contact Microsoft Support or your IT admin. If a third-party antivirus is still installed, remove it first and restart before spending time on deeper troubleshooting. That avoids chasing a conflict that keeps returning.

Frequently asked questions

Why is Windows Defender not working?

Most failures come from one of three layers: the Windows Security app, the WinDefend service, or Defender definitions. Start with Get-Service WinDefend in elevated PowerShell, then reset Microsoft.SecHealthUI, and only after that run DISM /Online /Cleanup-Image /RestoreHealth plus sfc /scannow.

Why is my Windows Defender not opening?

A non-opening Security app usually points to the Microsoft.SecHealthUI package. Open Terminal (Admin) and run Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage. If the app still opens to a blank page, run DISM and SFC next.

How do I fix Windows Defender not working?

Use a short ladder: restart, check Get-Service WinDefend, reset Microsoft.SecHealthUI, then repair Windows with DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow. If definitions are the problem, go to %ProgramData%\Microsoft\Windows Defender\Platform and run MpCmdRun.exe -RemoveDefinitions -All followed by MpCmdRun.exe -SignatureUpdate -MMPC.

Why does Windows Defender show a blank screen?

A blank screen often means the Windows Security UI is damaged, but policy corruption or broader system damage can look the same. Reset Microsoft.SecHealthUI first. If that does not restore the page, repair the Windows image with DISM and SFC before touching anything else.

How do I fix Windows Defender after resetting my PC?

After a reset, check whether SecurityHealthService is present and whether its Start value is 3 where that setting applies. Then run DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow. If Windows Security still fails, reset Microsoft.SecHealthUI again.