How to Fix Windows Defender Error (Windows Defender)
Quick Answer
The "Threat service has stopped" error in Windows Defender indicates that the core security service is not running, leaving your system unprotected. The fastest fix often involves restarting the service through the Services management console or performing a system restart.
What Causes This Error
- Corrupted or missing system files related to Windows Defender.
- Conflicts with other antivirus software installed on the system.
- Incorrect service configuration or disabled Windows Defender services.
- Malware infection preventing the security service from running.
- Outdated Windows operating system or Windows Defender definitions.
- Issues with Group Policy settings or Registry entries affecting Defender.
Step-by-Step Fixes
1Restart the Windows Defender Antivirus Service
- Press the 'Windows key + R' to open the Run dialog box.
- Type 'services.msc' and press 'Enter' to open the Services management console.
- Locate 'Windows Defender Antivirus Service' in the list. If it is not present, look for 'Microsoft Defender Antivirus Service'.
- Right-click on the service and select 'Restart'. If 'Restart' is grayed out, select 'Start'.
- Verify that the 'Startup type' for this service is set to 'Automatic'. If not, double-click the service, change the 'Startup type' to 'Automatic', click 'Apply', then 'OK'.
2Perform a Full System Scan with Windows Defender
- Open 'Windows Security' by searching for it in the Start menu.
- Click on 'Virus & threat protection'.
- Under 'Virus & threat protection updates', click 'Check for updates' to ensure your definitions are current.
- Click on 'Scan options' and select 'Full scan'.
- Click 'Scan now' to initiate the scan. This process may take a significant amount of time.
3Update Windows and Windows Defender Definitions
- Press the 'Windows key + I' to open Settings.
- Click on 'Update & Security' (or 'Windows Update' on Windows 11).
- Click 'Check for updates' and install any available cumulative updates or security intelligence updates.
- Restart your computer after all updates have been installed.
- Open 'Windows Security' and navigate to 'Virus & threat protection' > 'Virus & threat protection updates' to confirm definitions are up to date.
4Run System File Checker (SFC) and DISM
- Press the 'Windows key + X' and select 'Windows PowerShell (Admin)' or 'Command Prompt (Admin)'.
- In the elevated command prompt, type 'sfc /scannow' and press 'Enter'. Allow the scan to complete.
- After SFC completes, type 'DISM /Online /Cleanup-Image /RestoreHealth' and press 'Enter'. Allow this operation to complete.
- Restart your computer once both scans have finished.
- Check Windows Defender to see if the error has been resolved.
Advanced Fixes
Check and Modify Group Policy Settings
- Press the 'Windows key + R', type 'gpedit.msc', and press 'Enter' to open the Local Group Policy Editor.
- Navigate to 'Computer Configuration' > 'Administrative Templates' > 'Windows Components' > 'Microsoft Defender Antivirus'.
- Look for the policy setting 'Turn off Microsoft Defender Antivirus'.
- Double-click this policy. Ensure it is set to 'Not Configured' or 'Disabled'. If it's 'Enabled', change it, click 'Apply', then 'OK'.
- Navigate to 'Real-time Protection' under 'Microsoft Defender Antivirus' and ensure settings like 'Turn off real-time protection' are 'Not Configured' or 'Disabled'.
- Close the Group Policy Editor and restart your computer.
Reset Windows Defender via PowerShell
- Press the 'Windows key + X' and select 'Windows PowerShell (Admin)'.
- Type 'Set-MpPreference -DisableRealtimeMonitoring $false' and press 'Enter'. This command attempts to enable real-time protection.
- If the issue persists, you may need to reset Windows Defender settings. Type 'Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage' and press 'Enter'. This command attempts to reinstall the Windows Security app.
- Restart your computer after executing the command.
- Check Windows Defender functionality.
Frequently Asked Questions
What does 'Threat service has stopped' mean?
This message indicates that the core security component of Windows Defender, responsible for real-time protection and threat detection, is not running. This leaves your system vulnerable to malware and other security threats.
Can I use another antivirus with Windows Defender?
While Windows Defender is designed to work alongside other antivirus programs in a limited capacity (Passive Mode), having another active antivirus can sometimes conflict with Defender's services, leading to errors. It is generally recommended to use only one primary antivirus solution.
How often should I update Windows Defender?
Windows Defender should be updated regularly, ideally daily, to ensure it has the latest virus definitions and security intelligence. Windows typically handles these updates automatically, but manual checks are recommended if you encounter issues or after a system restart.
What if Windows Defender still won't start after trying these fixes?
If the issue persists, consider performing a Windows repair upgrade or a clean installation of Windows as a last resort. Before doing so, back up all important data. Malware infections can sometimes be deeply embedded, requiring more drastic measures.