Fix Windows Defender Service Started Then Stopped

If Windows Defender Antivirus Service starts and then stops on your local computer, the fix usually involves repairing corrupted service entries, checking for conflicting third-party antivirus software, or resetting the Windows Security app. This error typically appears in the Event Viewer or as a notification that real-time protection is off, leaving your PC vulnerable.

Below is a step-by-step guide to diagnose and resolve the issue, along with background on why it happens and what to do if the standard fixes don’t work.

What Causes the Service to Stop

The Windows Defender Antivirus Service (WinDefend) is designed to run continuously. When it starts and then stops, one of several things is usually at fault:

• Conflicting security software: Another antivirus or firewall program may have disabled Defender to avoid conflicts. Windows automatically turns off Defender when a third-party AV is installed, but sometimes the switch doesn’t happen cleanly.
• Corrupted system files: A damaged Windows Update, a failed driver update, or a malware infection can corrupt Defender’s service configuration.
• Outdated or broken Windows Security app: The Windows Security interface (the app you open from Settings) can become out of sync with the underlying service.
• Group Policy or registry settings: Some system administrators or optimization tools disable Defender via policy, and those settings persist even after the tool is removed.
• Tamper Protection interference: If Tamper Protection is on, it can block changes to Defender settings, but sometimes it prevents the service from restarting after an update.

How Windows Defender Is Supposed to Work

Windows Defender runs as a set of services, the most important being WinDefend (the main antivirus service) and WdNisSvc (the network inspection service). These are set to start automatically at boot. The Windows Security app acts as a control panel—it doesn’t do the scanning itself, but it communicates with the services.

When you see the error “The Windows Defender Antivirus Service terminated with service-specific error,” it usually means the service started but then crashed or was stopped by another process. The Event Viewer logs (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational) will show the exact error code, but the fix is often the same regardless of the code.

Step-by-Step Fixes to Try

Work through these in order. Most users resolve the issue with steps 1–3.

1. Restart the service manually: Press Win + R, type services.msc, and press Enter. Find Windows Defender Antivirus Service, right-click it, and select Start. If it starts and stays running, you’re done. If it stops again within seconds, continue.
2. Check for third-party antivirus remnants: Open Settings > Apps > Installed apps and look for any leftover antivirus or security tools. If you recently uninstalled one, use the vendor’s official removal tool to clean up leftover drivers and services. Do not uninstall your current antivirus unless you have another one ready—Windows Defender will not automatically enable itself if a conflicting product is still present.
3. Run the Windows Security built-in repair: Go to Settings > Windows Update > Advanced options > Recovery and click Reinstall Windows (this is a last resort). Instead, first try: Settings > System > Troubleshoot > Other troubleshooters and run the Windows Update troubleshooter. Then open an elevated Command Prompt (right-click Start > Terminal (Admin)) and run sfc /scannow, followed by DISM /Online /Cleanup-Image /RestoreHealth. Reboot.
4. Reset the Windows Security app: Go to Settings > Apps > Installed apps, find Windows Security, click the three dots, and choose Advanced options. Click Reset. This does not delete your personal files, but it will reset all security settings to defaults.
5. Re-register the Defender service: In an elevated PowerShell, run these commands one at a time:
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 0
   Then restart your PC.
6. Perform a clean boot: This isolates whether a third-party service is stopping Defender. Type msconfig in Start, go to the Services tab, check Hide all Microsoft services, click Disable all, then restart. If Defender works, re-enable services in batches to find the culprit.
7. Use the Windows Security Troubleshooter: Microsoft provides a dedicated tool called the Windows Security Troubleshooter (downloadable from the Microsoft Store). Run it and follow the prompts.
8. Reinstall Windows Defender via Windows Update: In rare cases, the Defender engine files are missing. Open Settings > Windows Update and check for updates. If none are available, go to Settings  Windows Update > Advanced options > Optional updates and install the latest Defender engine update.

Common Mistakes and Misconceptions

A frequent mistake is assuming that disabling a third-party antivirus in its own settings is enough. Many AV products leave kernel-level drivers behind that still block Defender. You must uninstall the product completely, not just disable it.

Another misconception is that the “DisableAntiSpyware” registry key is the solution. That key is used by Microsoft for enterprise management and is often set by “optimization” tools. Setting it to 0 is correct, but if the key is missing, you don’t need to create it—it’s not required for normal operation.

Also, do not attempt to change the service startup type to “Manual” or “Disabled” to fix the problem. This will break Defender permanently and may prevent Windows from booting if the service is required by other components.

When to Consider a System Restore or Reset

If none of the above steps work, you have two options:

• System Restore: If you have a restore point from before the problem started, go to Control Panel > Recovery > Open System Restore. Choose a point when Defender was working. This will not affect your personal files.
• Reset this PC: Go to Settings > System > Recovery > Reset this PC. Choose Keep my files to reinstall Windows while preserving your documents and apps (though apps will be removed). This is a last resort but almost always fixes service corruption.

Before resetting, back up your important files to an external drive, because even “Keep my files” can occasionally fail.

Preventing the Problem in the Future

To avoid recurrence:

• Keep Windows Update enabled—Defender engine updates are delivered through it.
• Do not use “debloater” or “privacy” scripts that disable Defender. They often break the service configuration.
• If you install a third-party antivirus, use the vendor’s official uninstaller when you remove it.
• Run a periodic sfc /scannow if you notice unusual system behavior.

Frequently Asked Questions

Why does Windows Defender keep stopping on its own?

It usually stops because another program is interfering—either a leftover antivirus driver, a corrupted update, or a group policy that disables it. The manual restart test helps isolate whether it’s a one-time crash or an ongoing conflict.

Will I lose my files if I reset Windows Security?

No. Resetting the Windows Security app only clears its settings and temporary data. Your personal files, photos, and documents are untouched. You may need to re-enable some toggles like Tamper Protection after the reset.

Can I just install a third-party antivirus instead?

Yes, but you should first uninstall any existing third-party AV completely. Installing another AV while Defender is broken may not fix the underlying service issue, and you could end up with two partially active security products, which causes more problems.

How do I know if the service is actually running?

Open Windows Security and look at the shield icon. If it shows a green checkmark, real-time protection is on. For a more technical check, open services.msc and look at the status of Windows Defender Antivirus Service—it should say “Running.”

Does this error mean my PC is infected?

Not necessarily. The error is often caused by software conflicts or corrupted files, not malware. However, if the service was disabled by malware, you should run a scan with Microsoft Defender Offline (available in Windows Security > Virus & threat protection > Scan options) after you get the service running.

What if the service starts but real-time protection is still off?

This usually means the security center is not communicating with the service. Try restarting the Security Center service (in services.msc) and then restart the Windows Defender Antivirus Service. If that fails, run the Windows Security Troubleshooter from the Microsoft Store.

Related

• How to Add Shapes in Google Docs
• Stop Android Background Data Use: Settings Guide
• How to Change Languages on Google Pixel & Pixel XL