Windows Defender Threat Service Has Stopped, Restart It Now

Answer

Let’s take a look at the typical reasons why the virus and threat protection feature (Microsoft Defender’s built-in antivirus) may not work on Windows 10. Check all items one by one.

Microsoft Defender Not Working Due to 3^rd Party Antivirus

Check if you have a third-party antivirus installed on your computer that prevents Microsoft Defender from working. Microsoft Defender Antivirus is automatically disabled if a third-party antivirus app is installed on your computer.

Please decide which antivirus you want to use – third-party or Microsoft Defender. If you don’t need a third-party antivirus, disable or uninstall it.

Enable Microsoft Defender Antivirus Services

In order the Microsoft Defender to work correctly on Windows 10, you need to check several services. Open the Services Management Console (services.msc) and make sure the following items are in the list of services:

• Windows Defender Advanced Threat Protection Service (Sense);
• Microsoft Defender Antivirus Network Inspection Service (WdNisSvc);
• Microsoft Defender Antivirus Service (WinDefend);
• Security Center (WSCSVC).

The status of the services can be checked using PowerShell:

get-service Sense, WdNisSvc, WinDefend, wscsvc | select name,status,starttype

The startup type must be Manual for the Sense and WdNisSvc services.

The Security Center (WinDefend) and Microsoft Defender Antivirus (wscsvc) services must be running. If these services are disabled, you won’t be able to use Microsoft Defender.

Verify that the startup type for the services is set to Automatic. If any service is stopped, start it manually. If all services are running, restart them.

Enable Microsoft Defender Using Registry on Windows 10

In versions of Windows 10 prior to build 2004, it was possible to disable Windows Defender through the registry. This could be done using the DisableAntiSpyware registry parameter. This option was usually used by OEMs or system administrators when a third-party antivirus app was intended to be used on the device.

Run the Registry Editor (regedit.exe) and go to the registry key HKLM\Software\Policies\Microsoft\Windows Defender. If the DisableAntiVirus and DisableAntiSpyware DWORD parameters are present in the right pane (at least one), remove them or change the value to 0.

Cannot edit DisableAntiSpyware. Error writing the value’s new contents.

The fact is that Windows Defender has a kernel-mode driver (wdfilter.sys) that registers a Registry callback filter which protects Defender’s registry keys.

Try to stop all Windows Defender related services before changing the registry.

Also try to take Ownership of a registry key HKLM\Software\Policies\Microsoft\Windows Defender and grant yourself Full Control permissions.

After that, try restarting the Virus and Threat Protection using the “Restart now” button. The service must start correctly.

Then go to Settings -> Windows Security -> Virus & threat protection -> Turn on.

Also check that the Real-time protection option is enabled under Windows Security -> Virus & threat protection -> Manage settings.

Microsoft Defender is now automatically disabled by Windows 10 if it detects a third-party antivirus installed on your device. If you don’t have a third-party antivirus installed and need to disable Microsoft Defender, first you need to disable the Microsoft Defender Tamper Protection. This Windows Security feature helps prevent malicious apps from modifying important Microsoft Defender Antivirus settings, including real-time and cloud protection. Tamper Protection can only be disabled through the Windows Security application, and a User Account Control (UAC) prompt will appear to confirm the change.

You can also disable Tamper Protection through the registry. To do this, you need to create a DWORD parameter named TamperProtection with a value of 0 under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features. But before that, you must first take ownership of the Features registry key.

Check That the Microsoft Defender in Enabled in Group Policy

Open the local Group Policy Editor (gpedit.msc) and verify that Microsoft Defender is not disabled via Group Policy. To do this, go to the section Computer Configuration -> Administrator Templates -> Windows Components -> Windows Defender Antivirus. Verify that the Turn off Microsoft Defender Antivirus policy is Not configured or Disabled.

Re-Register Microsoft Defender DLLs

Try to re-register the Windows Defender libraries. To do this, open a command prompt as administrator and run the following commands:
regsvr32 atl.dll
regsvr32 wuapi.dll
regsvr32 softpub.dll
regsvr32 mssip32.dll

Restart Microsoft Defender and check if the problem is fixed.

Check and Install Windows Updates

In rare cases, Microsoft Defender Antivirus may stop working after installing monthly Windows 10 updates. In this case, try to check for new updates and install them via Settings -> Update & Security -> Windows Update -> Check for updates or use PowerShell to install the latest updates. Most likely, they will fix the issue.

If nothing helps, check and repair the integrity of Windows image and system files with the commands:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

I hope this brief guide will help you solve the problem if you unable to start (stop) the threat service on Windows 10.