Turn Microsoft Defender Back On After Removing a Third-Party Antivirus

You removed a third-party antivirus (McAfee, Norton, Avast, AVG, etc.), but Windows Security still shows Microsoft Defender as off — or warns that your device isn’t protected.

Why: When a third-party antivirus is installed on a normal home PC, Defender automatically disables itself and stops scanning, so two products don’t fight. It’s supposed to re-enable itself once the other product expires or is uninstalled — but if the uninstall left registration entries or driver/service leftovers behind, Windows still thinks another antivirus is active and keeps Defender off. The fix is to make sure the old product is completely removed, then nudge Defender on.

Fix 1: Restart first — Defender often re-activates on its own

1. Make sure you’ve actually uninstalled the other product: Settings → Apps → Installed apps, find it, Uninstall.
2. Restart the PC. Re-activation frequently needs a reboot.
3. Open Windows Security → Virus & threat protection. If it shows Defender as your provider with no warnings, you’re done.

Fix 2: Run the vendor’s official removal tool

Standard uninstall often leaves pieces behind that keep Defender suppressed. Most antivirus makers publish a dedicated cleanup tool — use the one for your product:

1. Download the official removal/cleanup utility from the vendor (for example McAfee’s MCPR, Norton Remove and Reinstall, or Avast’s avastclear).
2. Run it, then restart.
3. Re-check Windows Security → Virus & threat protection. Defender should now report it’s protecting you.

Use only the official tool from the vendor’s own site for the exact product you removed — third-party “uninstaller” downloads are a common malware vector.

Fix 3: Turn real-time protection on manually

If the other product is fully gone but the toggle is just off:

1. Windows Security → Virus & threat protection → Virus & threat protection settings → Manage settings.
2. Set Real-time protection to On.
3. Restart for the change to fully take effect.

If the toggle is greyed out or says it’s managed, see real-time protection won’t turn on — usually leftover policy or Tamper Protection.

Fix 4: Confirm Defender is really running

1. Right-click Start → Terminal (Admin) and run Get-MpComputerStatus.
2. Check AntivirusEnabled and RealTimeProtectionEnabled — both should be True. You can also run Get-MpComputerStatus | select AMRunningMode; on a home PC with Defender protecting you it reports Normal.
3. If Defender still shows off or as not your provider, a leftover registration is present — go back to Fix 2 and run the vendor cleanup tool, then restart.

FAQ

Do I have to do anything, or does Defender just turn itself on? Usually it turns itself on after the other antivirus is fully uninstalled and you restart. The manual steps are only needed when removal left leftovers behind.

I removed the app but Windows still lists it as my antivirus. Leftover services/registration. Run the vendor’s official removal tool (Fix 2) and reboot — that clears the registration so Defender can take over.

Can I run Defender alongside another antivirus? On a normal home PC, no — Defender disables itself when another antivirus provides real-time protection, so the two don’t conflict. To have Defender protect you, the other real-time antivirus must be removed.

Sources: Microsoft Learn — Microsoft Defender Antivirus compatibility with other security products, Microsoft Support — Virus & threat protection in the Windows Security app