Microsoft Defender Antivirus is Snoozed; You’re using other antivirus providers

When you open Windows Security, the security dashboard may show the message “You’re using other antivirus providers.” even though you don’t have any third-party antivirus program installed.

In some cases, the real-time protection option would be available. But it reverts to “off” status immediately after you try to turn it on.

If you open the “Security Providers” page (windowsdefender://providers/), it says Microsoft Defender Antivirus is snoozed.

If you run the following WMIC command, the productstate field reads 401664. 401664 means “Snoozed and Fully updated.”

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get /format:list

Whereas the productState should be 397568 (On and Fully Updated.)

The above symptoms may happen even though the service configuration is correct and the Microsoft Defender Antivirus service can start correctly.

Cause

The message “You’re using other antivirus providers” is probably caused by a WMI repository corruption. Refreshing the WMI repository or rebuilding it might help.

Solution

Before proceeding, ensure no remnant entries for third-party antivirus software exist on the computer. If you were using a third-party antivirus program, uninstall it cleanly using the specialized uninstaller tool provided by your antivirus program vendor.

1) Refresh the WMI repository

To update the security providers’ information and start the Microsoft Defender real-time protection, open an admin Command Prompt, and run the following:

winmgmt /salvagerepository

The above command performs a consistency check on the WMI repository. If an inconsistency is detected, it rebuilds the repository.

---

2) Enable Microsoft Defender using MpCmdRun

Enable Microsoft Defender Antivirus using command-line (via admin Command Prompt)

"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

That should fix the issue in most cases.

---

 

3) Rebuild the WMI Repository

If refreshing the repository doesn’t help, rebuild the WMI repository as mentioned below:

Rebuilding the repository is not a risky process. Still, it’s advisable to have some backup or at least a System Restore Point (a system image backup may be an overkill for this situation) beforehand. This is in case resetting WMI breaks an existing app in a production environment.

Reset and Rebuild the Repository

Open an admin Command Prompt window and run these commands:

winmgmt /backup c:\wmi_repository.bak
winmgmt /resetrepository

Restart Windows. If that doesn’t solve the issue, run these commands in addition:

(Note: Stopping WMI will also stop the other services that depend upon WMI. Please attempt the procedure via Safe mode if the WMI service can’t be stopped. Antimalware service(s) that depend upon WMI may not stop and thus prevent WMI from stopping. In that case, the Safe mode should help.)

sc config winmgmt start= disabled
net stop winmgmt
ren %windir%\System32\wbem\repository repository.old
sc config winmgmt start= auto

Restart Windows.

To recreate the repository, you need to run a WMI-using application. The easiest way to do this is to launch the WMI MMC snap-in. To do so, right-click Start, click Run, and type wmimgmt.msc.

Right-click “WMI Control (Local)” and click Properties.

The above step recreates the repository, which might take a minute or so.

---

4) Install another antivirus program temporarily

If none of the above steps help, refresh the WMI and the “Security providers” status in the Windows Security dialog by installing a third-party antivirus or antimalware program such as Malwarebytes Premium Trial.

In the Malwarebytes Premium security dashboard, enable the “Always register Malwarebytes in the Windows Security Center” (Reference) option.

Malwarebytes should now register itself as a security provider.

After a few minutes, switch off the above setting in Malwarebytes.

If all goes well, Microsoft Defender Antivirus should enable itself automatically and register as the security provider.

(You may uninstall Malwarebytes Premium or continue using it alongside Microsoft Defender without any issues. However, after the trial period, Malwarebytes will downgrade to the free version, which doesn’t have the real-time protection feature.)