Fix Windows Defender Real Time Protection Turning Off and Keep It On Safely

Windows Defender's real-time protection may turn off by itself because of conflicts with other antivirus programs, system settings, or malware. To fix this, check for conflicting software, scan for malware, adjust group policies or registry settings, and re-enable real-time protection through Windows Security. These steps will restore protection without causing system issues.

Why does Windows Defender real-time protection keep turning off?

Windows Defender's real-time protection can disable itself for several reasons. A common cause is a conflict with third-party antivirus software, which often turns off Defender to avoid interference. Windows updates might temporarily disable real-time protection during installation or due to bugs. Group policies set by system administrators, especially on work or school computers, can intentionally disable Defender features. Malware or potentially unwanted programs may also try to turn off real-time protection to evade detection. Knowing these causes helps identify why the feature won't stay enabled.

Could other software or settings be turning off real-time protection?

Yes, other software and system settings can disable Windows Defender's real-time protection. If you have another antivirus program installed, it usually disables Defender automatically to prevent conflicts. You can confirm this by opening the Windows Security app and checking if another antivirus is active. Additionally, Windows security settings or group policies may be configured to disable real-time protection, especially on devices managed by organizations. These policies are applied through the Group Policy Editor or registry settings and can prevent Defender from staying enabled. Some security or optimization tools might also change these settings without notifying you.

How do I fix Windows Defender real-time protection turning off?

Follow these steps to safely fix and maintain real-time protection:

1. Scan your system for malware using a trusted antivirus or the Windows Defender Offline scan. Malware might be disabling Defender.
2. Check if a third-party antivirus is installed. If it is, try uninstalling it or temporarily disabling it to see if Defender stays enabled.
3. Use the Windows Security app to turn real-time protection back on:

Start > Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings > Real-time protection: Turn On

4. Check Group Policy settings (Administrator required):

Get-MpPreference | Select-Object DisableRealtimeMonitoring

If this shows DisableRealtimeMonitoring set to True, real-time protection is disabled by policy. To fix this, open the Group Policy Editor (gpedit.msc), go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection, and set any "Turn off real-time protection" policies to "Not configured" or "Disabled".

5. Verify registry settings (advanced users only):

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name DisableRealtimeMonitoring

If DisableRealtimeMonitoring is 1, change it to 0 or delete the key.

6. Restart your PC to apply these changes.

These steps should re-enable real-time protection and keep it running reliably.

How can I verify Windows Defender real-time protection is enabled and working?

To confirm real-time protection is active, open the Windows Security app and check the Virus & threat protection section; it should say "Real-time protection: On."

For a detailed check, run this PowerShell command as Administrator:

Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled

If the output is True, real-time protection is enabled. You can also review event logs:

• Open Event Viewer.
• Navigate to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

Look for recent entries showing real-time protection activity. If these confirm the feature is active, Defender is working as intended.

What can I do to prevent Windows Defender real-time protection from turning off again?

To keep real-time protection enabled consistently:

• Avoid installing multiple antivirus programs that conflict with Defender.
• Keep Windows and Windows Defender updated to fix bugs and improve reliability.
• Run regular malware scans to detect infections that might disable protection.
• Check security settings and group policies regularly, especially on managed devices.
• Be cautious with third-party system optimization or security tools that might change Defender settings without clear notice.

These actions help maintain a stable security setup where real-time protection stays active.

Before you start

This guide applies to Windows 10 and Windows 11 systems with Windows Defender (Microsoft Defender Antivirus) built-in. You'll need Administrator privileges to check or change Group Policy and registry settings. Restarting your PC will be necessary after making some changes. Before starting, confirm if you have any third-party antivirus installed and save any work to avoid data loss during restarts.

Conclusion

If Windows Defender's real-time protection keeps turning off, start by checking for conflicting antivirus software or malware. Adjust your system's security settings and group policies to restore protection. After fixing the issue, keep your system updated and monitor security settings regularly to prevent future problems. Staying proactive about these settings helps keep your device protected.

Frequently Asked Questions

Can malware disable Windows Defender real-time protection?

Yes. Some malware tries to disable real-time protection to avoid detection. That's why scanning with a trusted tool before re-enabling Defender is important.

Will installing another antivirus always disable Windows Defender real-time protection?

Usually, yes. Most third-party antivirus programs disable Defender automatically to prevent conflicts. You can check your system settings to confirm.

Can I re-enable real-time protection if Group Policy disables it?

On personal devices, you can adjust or remove the policy using Group Policy Editor or the registry with administrator rights. However, if your device is managed by an organization, group policies might prevent you from changing this setting.

Why does Windows update sometimes turn off real-time protection?

Windows may temporarily disable real-time protection during updates to avoid interference. It should turn back on automatically after the update finishes.