Symptoms
- Windows Security shows real-time protection off
- Notification that antivirus protection is disabled
- Setting won't stay on even after manually re-enabling it
- Third-party antivirus installed around the same time it started
Likely causes
- CommonThird-party antivirus taking over protectionWindows automatically disables its own real-time protection when another antivirus is active, which is normal.
- PossibleGroup policy or admin setting disabling itOn managed or work computers, IT policy can intentionally turn off certain protections.
- PossibleMalware disabling security softwareSome malware specifically targets and disables antivirus to avoid detection.
What to do
- Check if a third-party antivirus is installed; if so, this is often expected behavior and not a problem.
- If no other antivirus is installed, try manually turning real-time protection back on in Windows Security settings.
- Restart the computer and check if the setting holds after reboot.
- Check Task Manager for unfamiliar processes that might be interfering with security settings.
- Run Microsoft's standalone Malicious Software Removal Tool or a reputable second-opinion scanner.
- If on a work or managed computer, check with IT before assuming it's malware.
- If it keeps disabling itself with no other antivirus present, treat it as a likely infection and get a professional scan.
When to call a pro
If a scan can't identify why protection keeps disabling, a professional can check for deeper malware or corrupted system files.
Safety
Generally low risk
Generally low risk for a careful person. Stop if anything looks different from what this guide describes.