Fix Windows Defender Threat Service Has Stopped

If Windows Defender shows “Threat service has stopped. Restart it now,” the fix is usually to restart the service in the Windows Security app or via the Services console, then check for conflicting third-party antivirus software. This article walks through the exact steps to get Defender running again, explains why the error happens, and covers related issues like missing updates and corrupted system files.

What Causes the “Threat Service Has Stopped” Error

The message appears when the Windows Defender Antivirus Service (WinDefend) or the Security Center service (wscsvc) is not running. Common triggers include:

• Another antivirus program – Windows Defender automatically disables itself when a third-party AV is installed. If that AV is partially uninstalled or broken, Defender may stay off.
• Corrupted service configuration – Registry entries or service dependencies can become damaged after a Windows update or a crash.
• Group Policy or registry tweaks – Some “debloat” scripts or manual edits disable Defender components.
• Tamper Protection – If this security feature is off, malware can stop the service.
• Windows update issues – A pending or failed update can leave Defender in a broken state.

Step-by-Step: Restart the Defender Service

Start with the simplest fix – restarting the service manually. This works in most cases where the service was stopped by a glitch or a temporary conflict.

1. Press Windows + R, type services.msc, and press Enter.
2. Scroll to Windows Defender Antivirus Service (the display name may be “WinDefend”).
3. Right-click it and select Start (or Restart if it is already running).
4. If it will not start, double-click the service, set “Startup type” to Automatic, and click Apply.
5. Also check Security Center (wscsvc) – set it to Automatic and start it as well.
6. Reboot the PC and check Windows Security again.

If the service starts but the error returns after a reboot, continue to the next section.

Use the Windows Security App to Restart

Windows 10 and 11 provide a built-in restart button that often works better than the Services console because it also resets related components.

1. Open Windows Security (search for it in the Start menu).
2. Go to Virus & threat protection.
3. Under “Virus & threat protection settings,” click Manage settings.
4. If you see a yellow or red banner saying “Threat service has stopped,” click Restart now.
5. If Tamper Protection is off, turn it on – this prevents malware from disabling Defender.

If the button is grayed out or nothing happens, move on to the registry and policy checks below.

Check for Conflicting Antivirus Software

Windows Defender is designed to turn itself off when a third-party antivirus is active. If you recently uninstalled one but leftover drivers or services remain, Defender may not re-enable.

• Open Settings > Apps > Installed apps and look for any antivirus or security suite (e.g., Norton, McAfee, Avast, AVG, Bitdefender).
• If one is present, uninstall it using the vendor’s official removal tool if available – these tools clean leftover drivers.
• After uninstalling, restart the PC and check if Defender activates.
• If you still see the error, verify in Device Manager that no old filter drivers remain (look under “Non-plug and play drivers” via the View menu).

Do not keep two real-time antivirus programs running – they conflict and can cause exactly this type of failure.

Repair Corrupted System Files

If the service still fails, Windows may have corrupted system files. Run the built-in System File Checker and DISM tools.

1. Open Command Prompt as administrator (right-click Start > “Terminal (Admin)” or “Command Prompt (Admin)”).
2. Run sfc /scannow and wait for it to finish.
3. Then run DISM /Online /Cleanup-Image /RestoreHealth.
4. Reboot and try restarting the Defender service again.

This process can take 10–20 minutes. It does not remove personal files, but it may require a second reboot.

Use PowerShell to Re-register Defender

When the service is present but refuses to start, re-registering the Defender app can reset its configuration.

1. Open PowerShell as administrator.
2. Run: Get-AppxPackage Microsoft.Windows.SecHealthUI | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
3. Restart the PC.

This command reinstalls the Windows Security interface. It does not delete any files or settings.

When to Use the Windows Defender Offline Scan

If the service keeps stopping because malware is actively disabling it, run a Windows Defender Offline scan. This scan boots into a minimal environment before Windows loads, so malware cannot interfere.

1. Open Windows Security > Virus & threat protection.
2. Under “Current threats,” click Scan options.
3. Select Microsoft Defender Offline scan and click Scan now.
4. Your PC will restart and the scan will take about 15 minutes.

After the scan, Windows restarts normally, and the Defender service should be running. If it is still stopped, proceed to the next section.

Reset Windows Security via Group Policy or Registry

If you or a script disabled Defender via policy or registry, you need to undo that manually.

• Press Windows + R, type gpedit.msc (Pro/Enterprise only), and navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. Set “Turn off Microsoft Defender Antivirus” to Not Configured.
• If you do not have gpedit, open Registry Editor and go to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender. Delete any value named DisableAntiSpyware or DisableAntiVirus.
• Also check HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection and delete DisableRealtimeMonitoring if present.

Restart the PC after making these changes.

Frequently Asked Questions

Why does Windows Defender keep saying “Threat service has stopped” even after restart?

This usually means a conflicting antivirus is still installed, or the service’s startup type is not set to Automatic. Check Services.msc first, then look for leftover AV software. If neither helps, run sfc /scannow.

Is it safe to disable third-party antivirus to fix Defender?

Yes, but only if you intend to keep Windows Defender as your primary protection. Uninstall the third-party AV completely (use the vendor’s removal tool) rather than just disabling it, because leftover drivers can still block Defender.

Can I fix this without admin rights?

No. Starting or reconfiguring services, changing registry keys, and running system file checks all require administrator privileges. If you are on a work or school PC, contact your IT department.

Will resetting Windows Security delete my files?

No. Re-registering the app or running sfc /scannow does not touch your personal files. The Windows Defender Offline scan also leaves your documents and photos alone.

What if I see “Tamper Protection is off”?

Turn it back on immediately from Windows Security > Virus & threat protection > Manage settings. Tamper Protection prevents malware from changing Defender’s settings, including stopping the service.

Should I reinstall Windows if nothing works?

Only as a last resort. Before that, try the “Reset this PC” option that keeps your files, or use the Windows Update troubleshooter. If malware is deeply embedded, a clean install is the most reliable fix.

Related

• 500W USB-C Charging Station: How to Choose One
• How to Connect AirPods to MacBook Pro or Air
• How to Disable Auto Photo Upload to OneDrive on Windows Phone