Windows Defender Threat Service Has Stopped, Restart It Now

Answer

Let’s take a look at the typical reasons why the virus and threat protection feature (Microsoft Defender’s built-in antivirus) may not work on Windows 10. Check all items one by one.

Microsoft Defender Not Working Due to 3^rd Party Antivirus

Check if you have a third-party antivirus installed on your computer that prevents Microsoft Defender from working. Microsoft Defender Antivirus is automatically disabled if a third-party antivirus app is installed on your computer.

Please decide which antivirus you want to use – third-party or Microsoft Defender. If you don’t need a third-party antivirus, disable or uninstall it.

Enable Microsoft Defender Antivirus Services

In order the Microsoft Defender to work correctly on Windows 10, you need to check several services. Open the Services Management Console (services.msc) and make sure the following items are in the list of services:

• Windows Defender Advanced Threat Protection Service (Sense);
• Microsoft Defender Antivirus Network Inspection Service (WdNisSvc);
• Microsoft Defender Antivirus Service (WinDefend);
• Security Center (WSCSVC).

The status of the services can be checked using PowerShell:

get-service Sense, WdNisSvc, WinDefend, wscsvc | select name,status,starttype

The startup type must be Manual for the Sense and WdNisSvc services.

The Security Center (WinDefend) and Microsoft Defender Antivirus (wscsvc) services must be running. If these services are disabled, you won’t be able to use Microsoft Defender.

Verify that the startup type for the services is set to Automatic. If any service is stopped, start it manually. If all services are running, restart them.

Enable Microsoft Defender Using Registry on Windows 10

In versions of Windows 10 before build 2004, it was possible to disable Windows Defender through the registry. This could be done using the DisableAntiSpyware registry parameter. This option was usually used by OEMs or system administrators when a third-party antivirus app was intended to be used on the device.

Run the Registry Editor (regedit.exe) and go to the registry key HKLM\Software\Policies\Microsoft\Windows Defender. If the DisableAntiVirus and DisableAntiSpyware DWORD parameters are present in the right pane (at least one), remove them or change the value to 0.

After that, try restarting the Virus and Threat Protection using the “Restart now” button. The service must start correctly.

Then go to Settings -> Windows Security -> Virus & threat protection -> Turn on.

Also check that the Real-time protection option is enabled under Windows Security -> Virus & threat protection -> Manage settings.

Check That the Microsoft Defender is Enabled in Group Policy

Open the local Group Policy Editor (gpedit.msc) and verify that Microsoft Defender is not disabled via Group Policy. To do this, go to the section Computer Configuration -> Administrator Templates -> Windows Components -> Windows Defender Antivirus. Verify that the Turn off Microsoft Defender Antivirus policy is Not Configured or Disabled.

Re-Register Microsoft Defender DLLs

Try to re-register the Windows Defender libraries. To do this, open a command prompt as administrator and run the following commands:
regsvr32 atl.dll
regsvr32 wuapi.dll
regsvr32 softpub.dll
regsvr32 mssip32.dll

Restart Microsoft Defender and check if the problem is fixed.

Check and Install Windows Updates

In rare cases, Microsoft Defender Antivirus may stop working after installing monthly Windows 10 updates. In this case, try to check for new updates and install them via Settings -> Update & Security -> Windows Update -> Check for updates or use PowerShell to install the latest updates. Most likely, they will fix the issue.

If nothing helps, check and repair the integrity of Windows image and system files with the commands:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

I hope this brief guide will help you solve the problem if you are unable to start (stop) the threat service on Windows 10.