Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A Windows Defender status change does not, by itself, mean your PC has been attacked. A compatible third-party antivirus can turn Microsoft Defender Antivirus off automatically, and temporarily disabled real-time protection is supposed to turn back on after a short while. Check which provider is active and whether Windows Security recorded a threat before deciding what to do.
How can I tell if Windows Defender turned itself off?
Start by checking Windows Security rather than judging the Defender toggle alone. Open Windows Security > Virus & threat protection. Under Who’s protecting me?, select Manage providers to see which antivirus is protecting the device. Then check Current threats and Protection history for detections, quarantined items, or items that were previously allowed. Microsoft’s Virus & threat protection guidance describes these checks.
When is Defender turning off expected?
A compatible antivirus is installed
Microsoft says a compatible non-Microsoft antivirus automatically turns Microsoft Defender Antivirus off. If you recently installed another antivirus, check its status in Manage providers; an active provider may explain why Defender is not the current antivirus. After uninstalling that product, Defender should return to active mode automatically. Verify the provider again rather than assuming the handoff succeeded.
Microsoft cautions that removing security software can leave a PC unprotected. Also, running multiple antimalware products can cause slow performance, instability, or unexpected restarts. Check that Defender or another antivirus is active after any change. See Microsoft’s guidance on providers and protection settings and advice about antivirus conflicts.
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Real-time protection was switched off temporarily
If you deliberately turned off real-time protection, Microsoft says it turns itself back on after a short while. While it is off, files you open or download are not scanned in real time. Check the setting and confirm that real-time protection has resumed. If it remains off and no other provider explains the status, continue with the checks below. Microsoft explains this behavior in its real-time protection guidance.
What makes an unexplained change more concerning?
Take the change seriously if no known antivirus accounts for it, protection remains off, or Windows Security lists a detection. Malware may try to disable security software or change security settings to evade detection. Microsoft describes Tamper Protection as a safeguard that helps prevent malicious apps from changing settings such as real-time and cloud-delivered protection. These facts justify investigation, but they do not prove that malware caused a particular status change—or prove a device is clean. More detail is available in Microsoft’s malware response advice and Tamper Protection guidance.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Use Tamper Protection as a defense, not as a diagnostic verdict. Do not turn it off to try to restore Defender. Likewise, avoid broad exclusions: excluded files and folders are not checked by Defender in real time and can leave the PC vulnerable. Only consider an exclusion for a specific trusted item when there is a clear reason, as explained in Microsoft’s Windows Security settings guidance.
How to investigate and scan safely
- Review the record: In Windows Security > Virus & threat protection, inspect Current threats and Protection history. Review what was detected and whether an item was quarantined or allowed.
- Update security intelligence: Open Windows Security > Virus & threat protection > Protection updates and check for updates before scanning. Microsoft’s scan and update instructions cover the built-in tools.
- Run a full scan: Microsoft recommends a full scan when unwanted software is suspected. Allow it to complete and review the result in Windows Security.
- Use Microsoft Defender Offline if concerns persist: Save open work first. The scan restarts the PC into Windows Recovery Environment and checks for malware without loading Windows, making it harder for persistent malware to hide or defend itself. Check Protection history for the result.
- Scan a specific file or folder if needed: Right-click it and choose the Microsoft Defender scan option. On Windows 11, the option may be under Show more options.
Quick guide: expected status or needs investigation?
| What you find | What it suggests | What to do next |
|---|---|---|
| A compatible third-party antivirus appears as the active provider | Defender may be off because the other antivirus took over; this alone is not evidence of an attack. | Confirm the other product is active. If you remove it, verify that Defender or another antivirus becomes active afterward. |
| You switched off real-time protection and it resumes after a short while | This matches Microsoft’s documented temporary behavior. | Confirm real-time protection is on again and review the threat record if you still have concerns. |
| No known provider explains the change, protection stays off, or Windows Security reports threats | The status warrants investigation, but does not establish the cause by itself. | Review Protection history, update security intelligence, and run a full scan; consider an Offline scan if concerns persist. |
Windows 10 support status
Microsoft says Windows 10 support ended on October 14, 2025. After that date, free software updates, technical assistance, and security fixes are no longer provided through Windows Update. This is a separate issue from whether Defender is active on a particular PC. See Microsoft’s Windows 10 support and security troubleshooter information.
Quick Recap
Best Value
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #3
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
