Switching Defender back on is easy when it was only paused - and a proper recovery job when a tool took it apart. Either way, the job ends with proof, not hope: one status check that says protection is real.
People arrive here from three directions: they paused Defender and want certainty it resumed, they inherited a PC where someone disabled it, or a remover tool did its work and they have changed their mind. All three deserve the same ending - Defender verifiably on, updated, and scanning. This page walks the recovery in order of depth: the simple switches first, then removing the policy levers that hold Defender down, then service and signature repair, and finally the PowerShell health check that proves the job is done.
If everything accepts and stays on after a restart, you are nearly done - jump to the health check in the last section. If switches refuse, revert, or the page itself is broken or missing sections, a policy or a tool is holding Defender down. Keep going.
On Windows Pro and above, open the Local Group Policy Editor with gpedit.msc and go to Computer Configuration, Administrative Templates, Windows Components, Microsoft Defender Antivirus. If Turn off Microsoft Defender Antivirus is set to Enabled, set it to Not Configured. While you are there, check the Real-Time Protection subfolder for any "turn off" entries set the same way.
Remover scripts also write raw registry policy values. The known one is DisableAntiSpyware under the Windows Defender policy key; on a machine you are recovering, deleting that value (or setting it to 0) removes the script's lever. Edit the registry only if you are comfortable doing so, export the key first, and remember Tamper Protection may still refuse deeper changes - which, during recovery, is the guard working for you.
Open Services with services.msc and check Microsoft Defender Antivirus Service (WinDefend) is present and set to Automatic, and the Security Center and Windows Security Service entries are running. A service a remover deleted will simply be absent from this list - that is the signal to skip to the repair route in the next section instead of fighting here.
Then refresh the definitions: in Windows Security, under Virus and threat protection updates, choose Check for updates. From a terminal, the engine's own tool works too: "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate. Finish with a full scan from the Scan options page - the first scan after recovery is the one that tells you the engine truly works end to end.
If services are missing, the Security app is broken, or the switches will not hold, the installation itself is damaged and settings-level recovery is over. The supported ladder is: try sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth, each from an administrator terminal. If DISM reports it cannot find source files - common after file-deleting removers - mount a Windows ISO of the same build as the repair source, or go straight to an in-place repair install from that ISO, keeping files and apps. That rebuilds Defender with the rest of the Windows image, which is the only complete answer to a component that was forcibly removed.
End every recovery the same way: open PowerShell and run Get-MpComputerStatus. You are looking for AntivirusEnabled: True, RealTimeProtectionEnabled: True, behaviour monitoring and Tamper Protection on, and an antivirus signature timestamp from today. The panel at the top of this page shows the target state.
Then restart once more and check again. A recovery that survives a restart - and ideally a Windows Update cycle - is a recovery. One that only looks right until reboot was a policy lever you have not found yet, and the sections above are the map for finding it.
Removed Defender with the video's method and want the way back? This page is the route - watch the video, then recover with proof.
▶️ Watch Full VideoThat usually means its services were disabled or deleted by a tool, or the Windows image is damaged. Check Services for Microsoft Defender Antivirus Service. If it is absent, settings cannot bring it back - repair the image with SFC and DISM, using a same-build ISO as the source if needed, or perform an in-place repair install, which restores Defender with Windows.
There is likely a second lever: remover tools often combine the policy value with disabled services, deleted scheduled tasks and sometimes a Windows Defender entry in the registry policy branch set by a script you have not found. Work through the sections in order - policies, then services, then image repair - and verify with Get-MpComputerStatus after each step so you know which layer was holding it.
Two ways: Windows Security shows the last update time under Virus and threat protection updates, and Get-MpComputerStatus reports AntivirusSignatureLastUpdated. After recovery, force a check for updates once, confirm the timestamp is today, and run a full scan. Old signatures with a green-looking shield are exactly the half-recovered state to avoid.