On Windows Server 2016 and later, Microsoft Defender Antivirus is installed and enabled by default. On Windows Server 2025, it should already be present.
To check whether the Defender service is installed and running:
- Open PowerShell as administrator and run:
Get-Service -Name windefend - Or open Command Prompt as administrator and run:
sc query Windefend
If Defender was removed or uninstalled, reinstall it from an elevated session:
- PowerShell:
Install-WindowsFeature -Name Windows-Defender - DISM for Windows Server 2019 or later, including Windows Server 2025:
Dism /Online /Enable-Feature /FeatureName:Windows-Defender
Then reboot the server.
If Defender was disabled rather than removed:
- Make sure it is not being disabled by Group Policy or the registry.
- Install the latest servicing stack update and latest cumulative update.
- Re-enable or reinstall Defender.
- Reboot the system.
- Install the latest Defender platform update.
For security intelligence updates, make sure the Windows Update service is running. If WSUS is used, approve Microsoft Defender Antivirus security intelligence updates.
If the issue is only that Windows shows a notification saying Defender is off on Windows Server 2025, there is a known issue where Defender remains active and functioning correctly despite the notification.
References: