When you open Windows Security, the security dashboard may show the message “You’re using other antivirus providers.” even though you don’t have any third-party antivirus program installed.
In some cases, the real-time protection option would be available. But it reverts to “off” status immediately after you try to turn it on.
If you open the “Security Providers” page (windowsdefender://providers/), it says Microsoft Defender Antivirus is snoozed.
If you run the following WMIC command, the productstate field reads 401664. 401664 means “Snoozed and Fully updated.”
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get /format:list
Whereas the productState should be 397568 (On and Fully Updated.)
The above symptoms may happen even though the service configuration is correct and the Microsoft Defender Antivirus service can start correctly.
Cause
The message “You’re using other antivirus providers” is probably caused by a WMI repository corruption. Refreshing the WMI repository or rebuilding it might help.
Solution
Before proceeding, ensure no remnant entries for third-party antivirus software exist on the computer. If you were using a third-party antivirus program, uninstall it cleanly using the specialized uninstaller tool provided by your antivirus program vendor.
1) Refresh the WMI repository
To update the security providers’ information and start the Microsoft Defender real-time protection, open an admin Command Prompt, and run the following:
winmgmt /salvagerepository
The above command performs a consistency check on the WMI repository. If an inconsistency is detected, it rebuilds the repository.
2) Enable Microsoft Defender using MpCmdRun
Enable Microsoft Defender Antivirus using command-line (via admin Command Prompt)
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
That should fix the issue in most cases.
3) Rebuild the WMI Repository
If refreshing the repository doesn’t help, rebuild the WMI repository as mentioned below:
Rebuilding the repository is not a risky process. Still, it’s advisable to have some backup or at least a System Restore Point (a system image backup may be an overkill for this situation) beforehand. This is in case resetting WMI breaks an existing app in a production environment.
Reset and Rebuild the Repository
Open an admin Command Prompt window and run these commands:
winmgmt /backup c:\wmi_repository.bak winmgmt /resetrepository
Restart Windows. If that doesn’t solve the issue, run these commands in addition:
(Note: Stopping WMI will also stop the other services that depend upon WMI. Please attempt the procedure via Safe mode if the WMI service can’t be stopped. Antimalware service(s) that depend upon WMI may not stop and thus prevent WMI from stopping. In that case, the Safe mode should help.)
sc config winmgmt start= disabled net stop winmgmt ren %windir%\System32\wbem\repository repository.old sc config winmgmt start= auto
Restart Windows.
To recreate the repository, you need to run a WMI-using application. The easiest way to do this is to launch the WMI MMC snap-in. To do so, right-click Start, click Run, and type wmimgmt.msc.
Right-click “WMI Control (Local)” and click Properties.
The above step recreates the repository, which might take a minute or so.
4) Install another antivirus program temporarily
If none of the above steps help, refresh the WMI and the “Security providers” status in the Windows Security dialog by installing a third-party antivirus or antimalware program such as Malwarebytes Premium Trial.
In the Malwarebytes Premium security dashboard, enable the “Always register Malwarebytes in the Windows Security Center” (Reference) option.
Malwarebytes should now register itself as a security provider.
After a few minutes, switch off the above setting in Malwarebytes.
If all goes well, Microsoft Defender Antivirus should enable itself automatically and register as the security provider.
(You may uninstall Malwarebytes Premium or continue using it alongside Microsoft Defender without any issues. However, after the trial period, Malwarebytes will downgrade to the free version, which doesn’t have the real-time protection feature.)