Docs
How to Tell if Another Antivirus Disabled Microsoft Defender
Learn how to check whether a third-party antivirus product pushed Microsoft Defender out of the active protection role.
Troubleshooting for Admins and users checking whether a third-party AV sidelined Defender
This page focuses on a narrow but common confusion point: Defender is still present, but another antivirus may have taken the active role. Use it to confirm whether that handoff is expected or a problem.
What You'll Get
- Confirm whether another antivirus product took the active protection role
- Separate expected provider handoff from broken Defender state
- Choose the right next troubleshooting path after validation
Jump To
Short Answer
The fastest clue is that Defender is installed but not acting as the active antivirus engine. Check Windows Security plus Get-MpComputerStatus values like AMRunningMode, AntivirusEnabled, and RealTimeProtectionEnabled. If you are still sorting the symptom into the right bucket, start with the common Defender problems pillar.
Why This Happens
Microsoft Defender Antivirus commonly moves out of the active protection path when Windows detects another antivirus product. That behavior can be normal, but it creates confusion when users think Defender has been broken instead of intentionally deprioritized.
Signs Another Antivirus Took Over
- Windows Security shows another provider as the active antivirus.
- Defender appears installed but AntivirusEnabled or RealTimeProtectionEnabled is off.
- AMRunningMode indicates passive or non-active operation.
- Users cannot turn Defender back on while the third-party product remains installed.
Check Windows Security First
Open Windows Security and review which antivirus provider is shown as active.
If another product is listed as the active provider, Defender may still exist on the device but no longer own real-time protection.
Use PowerShell to Confirm Operating Mode
PS> Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled, NISEnabledThis separates a true Defender problem from a normal provider handoff.
How to Read the Result
If another antivirus is active and Defender is passive, the main issue may be product overlap rather than Defender failure.
If another antivirus was removed but Defender still does not return to active protection, check for stale services, leftover drivers, or policy remnants.
What to Do Next
- Decide which antivirus product should be the active engine on the endpoint.
- Remove the product that should not own protection.
- Restart and validate Defender status again.
- If Defender remains passive, continue with the passive mode guide.
When to Escalate
Escalate when the endpoint is organization-managed, another antivirus was recently removed but Defender still does not reactivate, or multiple endpoints show the same handoff issue at once. That usually points to policy or deployment drift instead of a one-device anomaly.