Share via

cant turn on real time virus scan as it is greyed under windows defender

RajShah-1334 0 Reputation points
2026-05-02T07:48:24.6733333+00:00

I removed Norton Security and went through all the steps to make sure Windows Defender was setup correctly.

Everything shows ok apart from inability to turn on real time virus scanning which is greyed out.

Windows Virus service is not present but Windows Defender is running.

How do I enable this ? Most things tried so far have not fixed it. I have run Microsoft security scan and it came clean although earlier it was showing 211 virus type things in the summary count.

I want to scan a downloaded file on the laptop.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-05-02T07:48:42.17+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    Real-time protection can be unavailable or greyed out if:

    • Another antivirus is still registered as active
    • Group Policy or tamper protection is blocking changes

    Use these steps to restore Microsoft Defender real-time protection so files can be scanned.

    1. Confirm Microsoft Defender Antivirus is active
      1. Open Start and search for Windows Security, then open it.
      2. Select Virus & threat protection.
      3. If the page shows another antivirus provider as active, fully uninstall that product and restart the device. Only one real-time antivirus should run at a time; running more than one can cause issues and is not recommended.
    2. Turn on real-time protection in Windows Security
      1. In Windows Security, select Virus & threat protection.
      2. Select Manage settings under Virus & threat protection settings (or use the shortcut: windowsdefender://threatsettings/).
      3. Under Real-time protection, toggle the switch to On.
      4. If the switch is still greyed out, check for Group Policy configuration (next step).
    3. Check Group Policy for “Turn off real-time protection” This applies to Windows editions with Local Group Policy Editor.
      1. In the taskbar search box, type gpedit and select Edit group policy.
      2. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection.
      3. Double‑click Turn off real-time protection.
      4. Set it to Disabled or Not configured, then select OK.
      5. Close Local Group Policy Editor and restart the device.
      Note: If tamper protection is enabled in Defender for Endpoint environments, changing this via Group Policy may be blocked until tamper protection is temporarily disabled by an administrator.
    4. Verify Microsoft Defender Antivirus is enabled
      1. Open Windows Security again.
      2. Select Virus & threat protection > Virus & threat protection settings.
      3. Confirm Real-time protection is now On.
    5. Scan the downloaded file Once real-time protection is enabled, either:
      • Run a Quick scan from Virus & threat protection > Quick scan, or
      • Right‑click the downloaded file in File Explorer and choose Scan with Microsoft Defender (if available), or
      • Use Quick scan via the shortcut: windowsdefender://quickscan/.

    If Microsoft Defender Antivirus is disabled because another security product is still partially installed, remove that product completely, restart, and Defender will normally turn itself back on. For optimal protection, also enable Cloud-delivered protection and Automatic sample submission under Virus & threat protection settings once real-time protection is working.

    References:

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.