WINDOWS DEFENDER

Hello,

This issue commonly occurs when a third‑party antivirus such as McAfee was preinstalled on the device. Even after uninstalling McAfee, some components may remain registered in Windows Security Center and continue to block Microsoft Defender Antivirus from becoming active. As a result, the Virus & threat protection section disappears from Windows Security.

To fully restore Microsoft Defender, try the following steps:

1. Reinstall McAfee and then uninstall it again using the official removal tool

McAfee often leaves behind WMI entries, Security Center registrations, and registry values that prevent Defender from re‑activating.

Reinstall McAfee, then run the official McAfee Consumer Product Removal Tool (MCPR) to remove all remaining components.

2. Check that the Windows Security UI is not hidden by policy

Open the Registry Editor and verify the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Virus and threat protection

If the value UILockdown exists and is set to 1, change it to 0.

Restart the device afterward.

After completing these steps, Windows Security should display the Virus & threat protection section again, and Microsoft Defender Antivirus should return to its active state.

On Windows 10/11, Windows Security is only an interface; the actual protection is provided by Microsoft Defender Antivirus or any third‑party antivirus. When a third‑party antivirus such as McAfee is installed and active, Microsoft Defender Antivirus is automatically disabled and Windows Security shows that third‑party product as the antivirus provider instead of its own “Virus & threat protection” experience.

Key points from the documented behavior:

1. Windows Security is just a front end
   • Windows Security is a client app that surfaces status and configuration for multiple security features (antivirus, firewall, SmartScreen, device security, etc.).
   • It uses the Windows Security Service and Windows Security Center Service to collect and display status from Microsoft Defender Antivirus and any third‑party security products.
   • Disabling or modifying these services does not disable Microsoft Defender Antivirus itself, but can cause Windows Security to show stale or incomplete information.
2. Microsoft Defender Antivirus and third‑party AV cannot both be primary at the same time
   • When a third‑party antivirus product is installed and kept up to date, Microsoft Defender Antivirus is disabled automatically and placed into a non‑active state.
   • Windows Security continues to run and will show that another provider is protecting the device under Virus & threat protection → Who’s protecting me? → Manage providers.
3. How to check whether any antivirus is currently protecting the device
   • Use Windows Security:
     1. Open the Start menu, type Security, and open Windows Security.
     2. Select Virus & threat protection.
     3. Under Who’s protecting me?, select Manage Providers.
     4. The page lists the current antivirus/anti‑malware provider (Microsoft Defender Antivirus or a third‑party product).
   • Use PowerShell:
     1. Open Windows PowerShell as administrator.
     2. Run:

                Get-MpComputerStatus
        

     3. This command shows the state of Microsoft Defender Antivirus on the device (for example, whether it is active, passive, or disabled).
4. Ensuring Microsoft Defender Antivirus is enabled when no third‑party AV is present
   • If no third‑party antivirus is installed and Defender is available, it should automatically become active and appear in Windows Security.
   • In the Windows Security app:
     1. Open Windows Security from Start.
     2. Select Virus & threat protection.
     3. Select Virus & threat protection settings.
     4. Turn Real‑time protection to On.
   • If Real‑time protection is turned off manually, it automatically turns back on after a short delay to maintain protection.
5. Windows Security visibility vs. actual protection
   • Even if some sections or UI elements in Windows Security are hidden or disabled by policy, that does not by itself disable Microsoft Defender Antivirus.
   • Windows Security can be configured so that sections are hidden, or the interface is restricted, but Defender can still be running in the background.
   • Conversely, if the Windows Security Center Service is disabled or misconfigured, Windows Security may show inaccurate or missing information about antivirus status, even though the underlying antivirus engine may still be installed.

Given these behaviors, the concrete way to verify protection on the laptop is:

• Confirm in Windows Security → Virus & threat protection → Manage Providers which product is listed as the antivirus provider.
• Run Get-MpComputerStatus in PowerShell to see whether Microsoft Defender Antivirus is present and what state it is in.
• Ensure Real‑time protection is turned on in Virus & threat protection settings if Microsoft Defender Antivirus is the provider.

If Windows Security is not listing any antivirus provider at all and Get-MpComputerStatus does not return a valid Microsoft Defender Antivirus state, the device is likely not protected and further remediation (for example, reinstalling or repairing the OS, or engaging Microsoft Support) is required.

References:

• Microsoft Defender Antivirus in the Windows Security app
• Microsoft Defender Antivirus in Windows Overview
• Windows Security
• Virus and Threat Protection in the Windows Security App
• Endpoint Protection client frequently asked questions