windows defender advanced threat protection won't run

For Windows 11 25H2, there is a known issue that can show incorrect notifications that Microsoft Defender Antivirus is turned off. Since Virus & threat protection looks normal, first determine whether this is only a false notification or an actual service problem.

1. Restart the PC once if not already done.
2. Check the core Defender services in an elevated PowerShell window:

Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status

Expected defaults from Microsoft:

• SecurityHealthService: Manual, Running
• WdBoot: Boot, Stopped after boot is normal
• WdFilter: Boot, Running
• WdNisDrv: Manual, Running
• WdNisSvc: Manual, Running
• WinDefend: Automatic, Running
• wscsvc: Automatic, Running

If those are in the expected state, the notification can be a display issue rather than Defender actually being off.

3. Check for third-party antivirus and uninstall it completely if present. Microsoft specifically recommends uninstalling non-Microsoft antivirus software when Microsoft Defender Antivirus is the primary antivirus.
4. Run Microsoft Safety Scanner to rule out malware.
5. Reset Defender definitions and platform from an elevated Command Prompt:

MpCmdRun.exe -RemoveDefinitions -All
MpCmdRun.exe -ResetPlatform

6. If policy corruption is suspected, back up Defender policy first, then remove Defender policy settings. Warning: this deletes Microsoft Defender Antivirus policy settings from the registry.

Backup:

New-Item -Path "C:\DefenderTemp" -ItemType Directory; Invoke-Command {reg export 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender' C:\DefenderTemp\_DefenderAVBackup.reg}

Remove policy:

Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force

After clearing policy, run the onboarding steps again if the device is managed for Defender for Endpoint.

7. Verify Tamper Protection is enabled.
8. Run Microsoft Update so Defender components and intelligence are refreshed.
9. If the issue is only the incorrect “turned off” notification on Windows 11 25H2, Microsoft documents a workaround involving the inpoutx64 driver. Warning: this requires a registry change, so back up the registry first. The documented workaround is:

• Open HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\inpoutx64
• Change Start to 4
• Restart the PC

10. If the Defender service still cannot be started from services.msc, note any exact error shown there and contact Microsoft Support with that error information.

A useful event log check is Windows Defender – Operational for:

• Event 5007: Defender configuration changed
• Event 5001: Real-time protection was disabled

References:

• Troubleshoot Microsoft Defender Antivirus service startup problems
• Troubleshoot Microsoft Defender for Endpoint onboarding issues
• Troubleshoot Windows Defender or Endpoint Protection client
• Windows 11, version 25H2 known issues and notifications