{"id":5125,"date":"2017-01-23T19:30:09","date_gmt":"2017-01-23T14:00:09","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=5125"},"modified":"2024-04-01T13:54:06","modified_gmt":"2024-04-01T08:24:06","slug":"windows-defender-disabled-real-time-protection-virus","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/","title":{"rendered":"Microsoft Defender: &#8220;Managed by your administrator&#8221; or &#8220;Your IT administrator has limited access&#8221;"},"content":{"rendered":"<p>In the aftermath of a malware attack, the Windows Defender Security settings page may show the message <strong><em>Some settings are managed by your organization<\/em><\/strong>\u00a0or <em><strong>This setting is managed by your administrator<\/strong><\/em>. The real-time protection and cloud-based protection options may remain disabled or grayed out.<\/p>\n<p>Here is what the Windows Defender Settings page might look like. The controls for real-time protection, cloud-based protection, and Automatic sample submission options may be disabled and locked down or grayed out.<!--more--><\/p>\n<figure id=\"attachment_19981\" aria-describedby=\"caption-attachment-19981\" style=\"width: 736px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-19981 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/defender-policies-managed-by-adminstrator.png\" alt=\"defender settings grayed out - managed by administrator\" width=\"746\" height=\"380\" \/><figcaption id=\"caption-attachment-19981\" class=\"wp-caption-text\">Windows Defender: &#8220;This setting is managed by your administrator.&#8221;<\/figcaption><\/figure>\n<p><em>If you&#8217;ve installed a 3rd party anti-virus, Windows Defender gets disabled automatically. It&#8217;s normal. In that case, you&#8217;ll see the message &#8220;You&#8217;re using other antivirus providers.&#8221; instead.<\/em><\/p>\n<p>If Microsoft Defender group policies or registry-based policy settings are in effect, the following error appears when opening the Security at a glance page:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/defender-security-page-not-available.png\" alt=\"defender windows security page not available\" width=\"701\" height=\"411\" class=\"alignnone size-full wp-image-26851\" \/><\/p>\n<pre class=\"err\">Page not available\n\nYour IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information.<\/pre>\n<p><strong>Virus &amp; Threat Protection is Missing?<\/strong><\/p>\n<p>In some situations, the Virus &amp; threat protection section may be missing. The Virus &amp; threat protection section in the Windows Security user interface lets you configure every aspect of the Microsoft Defender Antivirus &#8212; such as real-time protection, tamper protection, ransomware protection, Controlled folder access, and other important settings.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19980\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/virus-threat-protection-missing-1.png\" alt=\"virus and threat protection missing in defender settings\" width=\"739\" height=\"286\" \/><br \/>\nMalware and viruses may add registry entries that hide the Virus &amp; threat protection section from the user interface. This is caused by some registry-based Policy settings. (<a href=\"#virus_threat_protection\">Jump to this part.<\/a>)<\/p>\n<p>This post tells you how to activate Microsoft Defender real-time protection and other settings by removing the entire Microsoft Defender Antivirus registry-based policies previously added by malware, a 3rd party tweaker, or a privacy protection tool. The &#8220;Virus &amp; Threat Protection&#8221; section should also be restored automatically after removing all the Policies.<\/p>\n<h2>Cause<\/h2>\n<h4>Third-party privacy protection tools<\/h4>\n<p>If you have used third-party anti-spy tools such as O&amp;O ShutUp, make sure you reset all &#8220;Windows Defender and Microsoft SpyNet&#8221; settings in that program.<\/p>\n<h4>Connected to Domain\/Azure AD?<\/h4>\n<p>If you&#8217;ve connected your computer to a domain or work\/school account, please contact your IT administrator or disconnect the system from the work\/school account.<\/p>\n<p>Or disconnect from your Work\/School\/Azure AD by opening Settings \u2192 Accounts \u2192 Access work or school and click on your Azure AD account, and click Disconnect.<\/p>\n<h4>Malware?<\/h4>\n<p>Malware can add registry entries that disable the real-time monitoring capabilities of Windows Defender, and also hide certain parts of the Windows Defender user interface from users.<\/p>\n<p><em>First, make sure you eliminate malware with help from an expert or friend &#8212; given the complexity of the malware infestation, professional help may be suggested. You may also try <a href=\"https:\/\/www.winhelponline.com\/blog\/start-windows-defender-offline-scan\/\">Windows Defender Offline<\/a>. in addition.<\/em><\/p>\n<p>The malware removal procedure is complex and is beyond the scope of this article. After eradicating the malware, remove the registry-based policy settings added by malware.<\/p>\n<div class=\"qt\">\n<h3><a id=\"virus_threat_protection\"><\/a>Virus and Threat Protection missing?<\/h3>\n<p>If the Virus &amp; threat protection section is missing in the Defender user interface, it may be caused by one of the following group policy settings:<\/p>\n<ul>\n<li><code>Enable the headless UI mode<\/code> group policy setting (Registry value: <code>UILockdown<\/code>)<\/li>\n<li><code>Hide the virus and threat protection area<\/code> group policy (Registry value: <code>UILockdown<\/code>)<\/li>\n<li>A registry-based policy &#8212; value named <code>AllowUserUIAccess<\/code>.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19980\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/virus-threat-protection-missing-1.png\" alt=\"virus and threat protection missing in defender settings\" width=\"739\" height=\"286\" \/><\/p>\n<p>The following are the registry values that hide the <strong>Virus &amp; threat protection<\/strong> category in the Windows Defender Security user interface.<\/p>\n<pre>[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\UX Configuration]\nValue: UILockdown\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Virus and threat protection]\nValue: UILockdown\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Policy Manager]\nValue: AllowUserUIAccess<\/pre>\n<p>Clearing the above policies especially should reinstate the <strong>Virus &amp; threat protection<\/strong> option back. The &#8220;<code>defender-policies-remove.reg<\/code>&#8221; registry file below removes all the Microsoft Defender Policies and restores the Virus &amp; threat protection section as well.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19979\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/virus-threat-protection-missing-2.png\" alt=\"virus and threat protection missing in defender settings\" width=\"738\" height=\"286\" \/><\/p>\n<\/div>\n<h2>Remove All the Microsoft Defender Policies<\/h2>\n<h3>Option 1: Remove Microsoft Defender Registry-based Policies<\/h3>\n<div class=\"qt\"><strong>Note:<\/strong> The following procedure doesn&#8217;t apply or work if your system is connected to an AD\/domain, where domain group policies apply. This article is for standalone systems where a virus or malware has completely disabled Windows Defender and locked down the settings. However, if you have previously enabled the Policies using the Local Group Policy Editor (<code>gpedit.msc<\/code>) on the local computer, you need to follow &#8220;<a href=\"#gpedit\">Method 2<\/a>&#8221; to remove the Policies.<\/div>\n<hr \/>\n<h4>Automate the following registry modifications using <a href=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/defender-policies-remove.zip\">defender-policies-remove.reg<\/a> (zipped). Unzip and run the enclosed REG file. After running it, you may want to open the Registry Editor to ensure the &#8220;Windows Defender&#8221; Policies key doesn&#8217;t exist. Once done, restart Windows for the changes to take effect. If you&#8217;re unable to apply the above registry file, launch Windows in <a href=\"https:\/\/www.winhelponline.com\/blog\/start-windows-11-or-10-safe-mode\/\">Safe Mode<\/a> and try merging the file again.<\/h4>\n<hr \/>\n<p>To <strong>manually<\/strong> remove Microsoft Defender Antivirus policies using Regedit:<\/p>\n<ol>\n<li>Start the Registry Editor (regedit.exe) and go to the following branch:\n<pre>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender<\/pre>\n<\/li>\n<li>Export the branch to a <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-use-reg-files-registration-entries-windows\/\">.reg file<\/a>.<\/li>\n<li>Right-click &#8220;Windows Defender&#8221; and choose Delete.\n<p><figure id=\"attachment_5132\" aria-describedby=\"caption-attachment-5132\" style=\"width: 666px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-5132 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/defender-policies-5.png\" alt=\"windows defender registry \/ policy settings\" width=\"676\" height=\"418\" \/><figcaption id=\"caption-attachment-5132\" class=\"wp-caption-text\">Windows Defender Policy keys in the registry.<\/figcaption><\/figure><\/li>\n<li>Similarly, backup the following branch (if exists) to a .reg file:\n<pre>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection<\/pre>\n<\/li>\n<li>Delete the &#8220;Windows Advanced Threat Protection&#8221; key.<\/li>\n<li>Next, backup the following branch (if exists) to a .reg file:\n<pre>HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center<\/pre>\n<\/li>\n<li>Delete the &#8220;Windows Defender Security Center&#8221; key.<\/li>\n<li>Exit the Registry Editor.<\/li>\n<li>Restart Windows.<\/li>\n<\/ol>\n<p>Note that this completely clears the policy settings for Microsoft Defender Antivirus and <a href=\"https:\/\/www.winhelponline.com\/blog\/need-new-app-open-windows-defender-link\/\">Windows Security<\/a> page. By default, in a clean installation of Windows, no policies are set for Defender.<\/p>\n<p><em>After removing all the policies, you may want to <a href=\"https:\/\/www.winhelponline.com\/blog\/defender-enable-pua-pup-adware-protection\/\">enable PUA or adware protection in Windows Defender<\/a>. If you had already enabled the setting before, you&#8217;d need to <a href=\"https:\/\/www.winhelponline.com\/blog\/defender-enable-pua-pup-adware-protection\/\">redo the procedure<\/a> now.<\/em><\/p>\n<div class=\"rp\"><strong>RELATED:<\/strong> <a href=\"https:\/\/www.winhelponline.com\/blog\/windows-defender-service-missing-security-page-empty\/\">Windows Defender Service Missing; Security at a glance page is Empty<\/a><\/div>\n<hr>\n<h3><a id=\"gpedit\"><\/a>Option 2: Remove Windows Defender Policies using Group Policy Editor<\/h3>\n<p>If you have previously enabled Defender Policies using <code>gpedit.msc<\/code> (Windows 10\/11 Professional or higher editions), you&#8217;ll need to use the same tool to remove the policies. The relevant Microsoft Defender Antivirus Group Policies are available in the following branch of the Group Policy Editor (<code>gpedit.msc<\/code>).<\/p>\n<pre>Computer Configuration \u2192 Administrative Templates \u2192 Windows Components \u2192 Microsoft Defender Antivirus\nComputer Configuration \u2192 Administrative Templates \u2192 Windows Components \u2192 Windows Security<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19982\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png\" alt=\"Microsoft Defender Antivirus group policy settings\" width=\"723\" height=\"530\" \/><\/p>\n<p><em>Note that in earlier versions of Windows 10, the policy settings would be located under &#8220;Windows Defender&#8221; instead of &#8220;Microsoft Defender Antivirus&#8221;.<\/em><\/p>\n<p>There are 100+ policy settings in Windows 10\/11, with the items in every sub-branch put together.<\/p>\n<p><em>Running the Resultant Set of Policy utility (<code>Rsop.msc<\/code>) or <code>gpresult \/h &lt;path&gt;\\gpreport.html<\/code> command shows you which policies are currently enabled.<\/em><\/p>\n<figure id=\"attachment_19834\" aria-describedby=\"caption-attachment-19834\" style=\"width: 690px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-19834 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/policies-gpresult.png\" alt=\"gpresult defender policies\" width=\"700\" height=\"289\" \/><figcaption id=\"caption-attachment-19834\" class=\"wp-caption-text\">gpresult shows the policies in force on the computer<\/figcaption><\/figure>\n<p>You need to make sure they&#8217;re set to &#8220;Not configured.&#8221;<\/p>\n<h4>Microsoft Defender Antivirus<\/h4>\n<pre>Allow antimalware service to startup with normal priority\nTurn off Microsoft Defender Antivirus\nConfigure local administrator merge behavior for lists\nTurn off routine remediation\nControl whether or not exclusions are visible to Local Admins\nDefine addresses to bypass proxy server\nDefine proxy auto-config (.pac) for connecting to the network\nDefine proxy server for connecting to the network\nRandomize scheduled task times\nConfigure detection for potentially unwanted applications\nAllow antimalware service to remain running always<\/pre>\n<p>Also, check the following sub-branches in the above location, and set each policy setting to &#8220;Not configured.&#8221;<\/p>\n<h4>Microsoft Defender Antivirus\\Client Interface<\/h4>\n<pre>Display additional text to clients when they need to perform an action\nSuppress all notifications\nSuppresses reboot notifications\nEnable headless UI mode<\/pre>\n<h4>Microsoft Defender Antivirus\\Device Control<\/h4>\n<pre>Define device control policy groups\nDefine device control policy rules<\/pre>\n<h4>Microsoft Defender Antivirus\\Exclusions<\/h4>\n<pre>Turn off Auto Exclusions\nExtension Exclusions\nPath Exclusions\nProcess Exclusions<\/pre>\n<h4>Microsoft Defender Antivirus\\MAPS<\/h4>\n<pre>Configure the 'Block at First Sight' feature\nJoin Microsoft MAPS\nConfigure local setting override for reporting to Microsoft MAPS\nSend file samples when further analysis is required<\/pre>\n<h4>Microsoft Defender Exploit Guard\\Attack Surface Reduction<\/h4>\n<pre>Exclude files and paths from Attack Surface Reduction Rules\nConfigure Attack Surface Reduction rules<\/pre>\n<h4>Microsoft Defender Exploit Guard\\Controlled Folder Access<\/h4>\n<pre>Configure allowed applications\nConfigure Controlled folder access\nConfigure protected folders<\/pre>\n<h4>Microsoft Defender Exploit Guard\\Network Protection<\/h4>\n<pre>Prevent users and apps from accessing dangerous websites<\/pre>\n<h4>Microsoft Defender Antivirus\\MpEngine<\/h4>\n<pre>Enable file hash computation feature\nConfigure extended cloud check\nSelect cloud protection level<\/pre>\n<h4>Microsoft Defender Antivirus\\Network Inspection System<\/h4>\n<pre>Turn on definition retirement\nSpecify additional definition sets for network traffic inspection\nTurn on protocol recognition<\/pre>\n<h4>Microsoft Defender Antivirus\\Quarantine<\/h4>\n<pre>Configure local setting override for the removal of items from Quarantine folder\nConfigure removal of items from Quarantine folder<\/pre>\n<h4>Microsoft Defender Antivirus\\Real-time Protection<\/h4>\n<pre>Turn off real-time protection\nTurn on behavior monitoring\nScan all downloaded files and attachments\nMonitor file and program activity on your computer\nTurn on raw volume write notifications\nTurn on process scanning whenever real-time protection is enabled\nDefine the maximum size of downloaded files and attachments to be scanned\nConfigure local setting override for turn on behavior monitoring\nConfigure local setting override for scanning all downloaded files and attachments\nConfigure local setting override for monitoring file and program activity on your computer\nConfigure local setting override to turn on real-time protection\nConfigure local setting override for monitoring for incoming and outgoing file activity\nConfigure monitoring for incoming and outgoing file and program activity<\/pre>\n<h4>Microsoft Defender Antivirus\\Remediation<\/h4>\n<pre>Configure local setting override for the time of day to run a scheduled full scan to complete remediation\nSpecify the day of the week to run a scheduled full scan to complete remediation\nSpecify the time of day to run a scheduled full scan to complete remediation<\/pre>\n<h4>Microsoft Defender Antivirus\\Reporting<\/h4>\n<pre>Configure time out for detections requiring additional action\nConfigure time out for detections in critically failed state\nTurn off enhanced notifications\nConfigure Watson events\nConfigure time out for detections in non-critical failed state\nConfigure time out for detections in recently remediated state\nConfigure Windows software trace preprocessor components\nConfigure WPP tracing level<\/pre>\n<h4>Microsoft Defender Antivirus\\Scan<\/h4>\n<pre>Check for the latest virus and spyware security intellgence before running a scheduled scan\nAllow users to pause scan\nSpecify the maximum depth to scan archive files\nSpecify the maximum size of archive files to be scanned\nSpecify the maximum percentage of CPU utilization during a scan\nScan archive files\nTurn on catch-up full scan\nTurn on catch-up quick scan\nTurn on e-mail scanning\nTurn on heuristics\nScan packed executables\nScan removable drives\nTurn on reparse point scanning\nCreate a system restore point\nRun full scan on mapped network drives\nScan network files\nConfigure local setting override for maximum percentage of CPU utilization\nConfigure local setting override for the scan type to use for a scheduled scan\nConfigure local setting override for schedule scan day\nConfigure local setting override for scheduled quick scan time\nConfigure local setting override for scheduled scan time\nConfigure low CPU priority for scheduled scans\nDefine the number of days after which a catch-up scan is forced\nTurn on removal of items from scan history folder\nSpecify the interval to run quick scans per day\nStart the scheduled scan only when computer is on but not in use\nSpecify the scan type to use for a scheduled scan\nSpecify the day of the week to run a scheduled scan\nSpecify the time for a daily quick scan\nSpecify the time of day to run a scheduled scan<\/pre>\n<h4>Microsoft Defender Antivirus\\Security Intelligence Updates<\/h4>\n<pre>Define the number of days before spyware security intelligence is considered out of date\nDefine the number of days before virus security intelligence is considered out of date\nDefine file shares for downloading security intelligence updates\nTurn on scan after security intelligence update\nAllow security intelligence updates when running on battery power\nInitiate security intelligence update on startup\nDefine the order of sources for downloading security intelligence updates\nAllow security intelligence updates from Microsoft Update\nAllow real-time security intelligence updates based on reports to Microsoft MAPS\nSpecify the day of the week to check for security intelligence updates\nSpecify the time to check for security intelligence updates\nDefine security intelligence location for VDI clients\nAllow notifications to disable security intelligence based reports to Microsoft MAPS\nDefine the number of days after which a catch-up security intelligence update is required\nSpecify the interval to check for security intelligence updates\nCheck for the latest virus and spyware security intelligence on startup<\/pre>\n<h4>Microsoft Defender Antivirus\\Threats<\/h4>\n<pre>Specify threats upon which default action should not be taken when detected\nSpecify threat alert levels at which default action should not be taken when detected<\/pre>\n<h4>Windows Components\\Windows Security\\Account Protection<\/h4>\n<pre>Hide the Account protection area<\/pre>\n<h4>Windows Components\\Windows Security\\App and browser protection<\/h4>\n<pre>Prevent users from modifying settings\nHide the App and browser protection area<\/pre>\n<h4>Windows Components\\Windows Security\\Device performance and health<\/h4>\n<pre>Hide the Device performance and health area<\/pre>\n<h4>Windows Components\\Windows Security\\Device performance and health<\/h4>\n<pre>Disable the Clear TPM button\nHide the TPM Firmware Update recommendation\nHide the Secure boot area\nHide the Security processor (TPM) troubleshooter page\nHide the Device security area<\/pre>\n<h4>Windows Components\\Windows Security\\Enterprise Customization<\/h4>\n<pre>Specify contact company name\nSpecify contact email address or Email ID\nConfigure customized notifications\nConfigure customized contact information\nSpecify contact phone number or Skype ID\nSpecify contact website<\/pre>\n<h4>Windows Components\\Windows Security\\Family options<\/h4>\n<pre>Hide the Family options area<\/pre>\n<h4>Windows Components\\Windows Security\\Firewall and network protection<\/h4>\n<pre>Hide the Firewall and network protection area<\/pre>\n<h4>Windows Components\\Windows Security\\Notifications<\/h4>\n<pre>Hide non-critical notifications\nHide all notifications<\/pre>\n<h4>Windows Components\\Windows Security\\Systray<\/h4>\n<pre>Hide Windows Security systray<\/pre>\n<h4>Windows Components\\Windows Security\\Virus and threat protection<\/h4>\n<pre>Hide the Ransomware data recovery area\nHide the Virus and threat protection area<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-6338\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/icotip.gif\" alt=\"tips bulb icon\" width=\"34\" height=\"34\" \/>If some of them already read as &#8220;Not configured&#8221;, set it to &#8220;Enable, click Apply and set it back to &#8220;Not configured.&#8221; This is to clear the registry values successfully.<\/p>\n<p>Last updated on 17-Aug-2022 for Windows 10 21H2.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the aftermath of a malware attack, the Windows Defender Security settings page may show the message Some settings are managed by your organization\u00a0or This setting is managed by your administrator. The real-time protection and cloud-based protection options may remain disabled or grayed out. Here is what the Windows Defender Settings page might look like. &#8230; <a title=\"Microsoft Defender: &#8220;Managed by your administrator&#8221; or &#8220;Your IT administrator has limited access&#8221;\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/\" aria-label=\"Read more about Microsoft Defender: &#8220;Managed by your administrator&#8221; or &#8220;Your IT administrator has limited access&#8221;\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,869],"tags":[441,661],"class_list":["post-5125","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-registry","tag-windows-defender"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5966,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-by-malwarebytes-antivirus-protection\/","url_meta":{"origin":5125,"position":0},"title":"Fix: Malwarebytes Disables Defender or 3rd Party Anti-Virus","author":"Ramesh","date":"November 22, 2017","format":false,"excerpt":"After installing Malwarebytes Premium 14-day trial or licensed product, your anti-virus software (e.g., Microsoft Defender Antivirus) may get disabled automatically. In this scenario, when you attempt to start the Microsoft Defender Antivirus Service\u00a0(WinDefend) via the Services console, it shows the following error, and the service wouldn't start. The Windows Defender\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"malwarebytes security center register","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":8717,"url":"https:\/\/www.winhelponline.com\/blog\/enable-or-disable-defender-shortcut-command-line\/","url_meta":{"origin":5125,"position":1},"title":"Enable or Disable Windows Defender Using Shortcut or Command-line","author":"Ramesh","date":"April 18, 2019","format":false,"excerpt":"Windows Defender, the built-in anti-virus program in Windows, has useful features such as cloud-based protection, offline scanning, limited periodic scanning, tamper protection, controlled folder access, etc. Almost every aspect of Windows Defender can be managed or automated using the MpCmdrun.exe command-line tool and PowerShell cmdlets. There are times when you\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"advancedrun command-line to disable defender","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/advanced-run-command-line-defender.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":18890,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-service-missing-security-page-empty\/","url_meta":{"origin":5125,"position":2},"title":"Windows Defender Service Missing; Security at a glance page is Empty","author":"Ramesh","date":"September 26, 2020","format":false,"excerpt":"In the aftermath of malware infection, when you open the Services MMC on a Windows 10 or 11 computer, you may find that the Windows Defender (\"Microsoft Defender Antivirus Service\") service is missing from the Services MMC. The Windows Security settings \"Security at a glance\" page may show up empty\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"advancedrun start regedit.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/advancedrun-start-regedit.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":47041,"url":"https:\/\/www.winhelponline.com\/blog\/cant-delete-defender-exclusions\/","url_meta":{"origin":5125,"position":3},"title":"Fix: Cannot Delete Microsoft Defender Exclusions","author":"Ramesh","date":"May 19, 2023","format":false,"excerpt":"When you open Windows Security \u2192 Virus and Threat Protection\u00a0 \u2192 Manage Settings \u2192 Add or remove exclusions, you may be able to delete the exclusions by clicking on the \"Remove\" button. Also, the Remove-MpPreference PowerShell command may not help. RELATED: How to Bulk Reset Exclusions in Windows Defender Cause\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"malwarebytes register security center","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/malwarebytes-enable-security-center.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5610,"url":"https:\/\/www.winhelponline.com\/blog\/use-controlled-folder-access-windows-10-windows-defender\/","url_meta":{"origin":5125,"position":4},"title":"How to Configure Controlled Folder Access to Stop &#8220;Unauthorized changes blocked&#8221; Notifications","author":"Ramesh","date":"October 21, 2017","format":false,"excerpt":"Windows 10 and 11 include a beneficial security feature named Controlled folder access, which is part of the Microsoft Defender Exploit Guard. You may have noticed the Unauthorized changes blocked notifications. Microsoft Defender's Controlled folder access feature is the one behind those notifications. Controlled folder access helps you protect valuable\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"defender controlled folder access - blocked apps list","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":4632,"url":"https:\/\/www.winhelponline.com\/blog\/defender-block-at-first-sight-cloud-protection\/","url_meta":{"origin":5125,"position":5},"title":"How Windows Defender &#8220;Block at First Sight&#8221; Cloud Protection Feature works?","author":"Ramesh","date":"November 21, 2016","format":false,"excerpt":"Windows Defender or the Microsoft anti-malware platform protects home computers, servers and online services such as Office 365. With the wealth of threat intelligence and telemetry data, Defender's cloud backend is an astounding malware protection service. When a new malware appears in the wild, it can take hours for the\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"defender block at first sight","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/defender-1.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=5125"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5125\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=5125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=5125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=5125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}