"Threat Service Has Stopped. Restart It Now": Fix Windows Security
If Windows Security shows a red X and the words "Threat service has stopped. Restart it now," the fastest real fix is to check that the underlying Defender services (WinDefend, WdFilter, SecurityHealthService) are actually running, then reset the Defender platform with two MpCmdRun.exe commands — not by editing the registry, because on any Windows 10 or 11 PC with Tamper Protection on, that registry edit is designed to fail. The button everyone clicks makes it worse before it makes it better: pressing "Restart it now" tells Windows to retry starting a service that's already failing, and about a third of the time that retry itself throws a second error — "Unexpected error. Sorry, we ran into a problem" — which looks like a new bug but is really the same one, twice.
What "Threat service has stopped" actually means
Jake found this one at the worst possible time — a customer had dropped off a laptop that "kept popping up a red warning," and Jake needed to know in thirty seconds whether it was safe to plug the customer's USB drive into it.
♂️ Jake's Reality Check
"So is this a virus telling me it's a virus, or is my antivirus just broken?"
Neither, necessarily. The message is Windows Security honestly reporting that one of the background services Microsoft Defender Antivirus depends on isn't running. That can be caused by malware disabling it — but far more often it's a leftover from a third-party antivirus install, a broken update, or a corrupted setting. The message itself doesn't tell you which.
Microsoft's own troubleshooting documentation for this exact screen describes it as Microsoft Defender Antivirus being turned off at the service level, visible in two places: the Virus & threat protection tile shows the red X and "Threat service has stopped. Restart it now," and under Security Providers you'll separately see "Microsoft Defender Antivirus is turned off." Those are two views of the same underlying fact — a required Windows service didn't start.
The relevant services are: WinDefend (Microsoft Defender Antivirus Service), WdBoot (its boot driver), WdFilter (the mini-filter driver that actually intercepts files), WdNisSvc and WdNisDrv (Network Inspection), SecurityHealthService (the "Windows Security Service" that runs the app itself), and wscsvc (Security Center, which reports status to Windows). If any of the ones marked as needing to run aren't running, that's your "threat service."
What changed between versions
- Before Windows 10, version 1903: the registry value
DisableAntiSpywareunderHKLM\SOFTWARE\Policies\Microsoft\Windows Defendercould turn Defender off directly, and people used it deliberately or picked it up from old malware. - From 1903 onward: Tamper Protection ships enabled by default for consumer devices, and it's specifically designed to ignore or revert that value and the matching Group Policy setting.
- What that means now: a "fix" you'll still find on forums from 2019–2021 — flip
DisableAntiSpywareto 1 — either does nothing on a current Windows 11 or 10 PC, or gets silently reverted, which is why so many threads end with "I did this and it still doesn't work."
Two minutes before you touch anything
"Elevated PowerShell" is going to come up a lot in this post, so it's worth explaining once, properly. Right-click the Start button (or press Win + X) and choose Terminal (Admin) — on older builds it may say Windows PowerShell (Admin). "Elevated" just means the window is running with administrator permission, which most of these commands require because they touch system services, not your personal files. You'll see a User Account Control prompt first; click Yes.
- Open an elevated PowerShell window as described above.
- Run:
Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status - Read the Status column.
WdBootshowing Stopped is normal after startup. Anything else showing Stopped or Disabled is your actual problem. - Note which services are down before you do anything else — it changes which fix applies.
While you're in there, run a scan with malware in mind, not as a formality. Microsoft's own Safety Scanner is a free, on-demand tool for exactly this situation — it doesn't touch your existing antivirus and doesn't need Defender to be working to run, which matters if Defender is the thing that's broken. Download it, run it as administrator, and let it finish a Full scan before you go further. If it finds and removes something, re-check the service list from step 2 — a lot of "threat service has stopped" cases resolve right there.
Fixing it on Windows 11
This is the order Microsoft's own defender-endpoint documentation gives, written for the person sitting at a home PC rather than an IT department. Do these in sequence — skipping ahead is the most common reason people report the fix "not working."
1. Rule out a leftover third-party antivirus
Microsoft Defender Antivirus turns itself off automatically when it detects another antivirus product registered with Windows. If you installed a third-party antivirus and later removed it, the uninstaller sometimes leaves Defender switched off because Windows never got told the other product is gone. Jake sees this exact scenario at the shop at least once a month: a customer swears they never installed a second antivirus, but a "free PC cleaner" or a trial security suite bundled one in during setup without ever showing an install prompt clearly labeled antivirus. Open Settings > Apps > Installed apps and check for antivirus software you don't remember installing or forgot to remove, then uninstall it properly through its own uninstaller if you find one, not just by deleting its folder.
2. Remove definitions and reset the platform
This is the step most guides skip, and it's the one that actually fixes a corrupted Defender install rather than just restarting a service that will immediately stop again. In an elevated Command Prompt:
- Navigate to the Defender platform folder. The command Microsoft documents changes directory to the newest version folder under
%ProgramData%\Microsoft\Windows Defender\Platform\, falling back to%ProgramFiles%\Microsoft Defenderif that path doesn't exist. - Run
MpCmdRun.exe -RemoveDefinitions -Allto clear the Security Intelligence and engine files. - Run
MpCmdRun.exe -ResetPlatformto reset Defender to its default state. - Run
MpCmdRun.exe -WdEnableto re-enable Microsoft Defender Antivirus. - Run
MpCmdRun.exe -SignatureUpdate -MMPCto pull fresh Security Intelligence updates.
⚠️ What this actually breaks
-RemoveDefinitions -All deletes Defender's current virus definitions and engine, not your files or your scan history. But it does mean your PC is running on whatever definitions -SignatureUpdate pulls down next, so don't skip that step or disconnect from the internet mid-process — you'd be left with an antivirus that has no idea what current threats look like.
3. Clear stuck Group Policy settings
If your PC ever had Group Policy applied to it — a work laptop that's since gone personal, or software that quietly set policies — a leftover policy can hold Defender off even after everything else is clean. Back it up first, then remove it, both in an elevated PowerShell session:
- Back up:
New-Item -Path "C:\DefenderTemp" -ItemType Directory; Invoke-Command {reg export 'HKLM\SOFTWARE\Policies\Microsoft\Windows Defender' C:\DefenderTemp\_DefenderAVBackup.reg} - Remove:
Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force
4. Confirm Tamper Protection is on — don't turn it off to "help"
Tamper Protection is a Windows 11 and 10 setting under Windows Security > Virus & threat protection > Manage settings that locks Defender's own configuration so malware — or a confused registry edit — can't quietly switch it off. After you've done steps 1–3, check that Tamper Protection reads as On.
✅ Why this is the one to use
Fixing the service and leaving Tamper Protection on is the right order. Turning Tamper Protection off first, just so a registry edit will "stick," fixes nothing about why the service stopped — it just removes the safeguard that would have caught it.
Ethan is blunt about this one when Jake asks about it.
♂️ Jake's Reality Check
"A forum post told me to turn off Tamper Protection so I can edit the registry and force Defender back on. Should I?"
"That's the worst suggestion on this list," Ethan says. "Tamper Protection exists specifically to stop exactly that kind of edit from sticking, on purpose, because it's the same edit malware uses to disable your antivirus permanently. Turning it off to 'unblock' a fix is turning off the lock because the key isn't working — and then people forget to turn it back on."
Windows 11 UI traps that trip people up mid-fix
None of this is unique to Defender, but it derails people mid-repair. The right-click menu on Windows 11 is condensed by default — the classic options (including anything that shows a full property sheet) live under Show more options, or you can hold Shift and right-click to get the full menu directly. If a guide tells you to right-click a service in the old-style menu and you can't find "Properties," that's why.
Settings has also absorbed most of what used to live in Control Panel. Local Group Policy Editor (gpedit.msc) still opens the same way it always did via Run, and it's still only available on Windows 11 Pro, Enterprise, and Education — Home edition doesn't ship it. If you're on Home and a step says "open Group Policy Editor," that step doesn't apply to you; the registry path is the Home equivalent, with the caveat above about Tamper Protection.
Fixing it on Windows 10
Every step above — the service check, the Safety Scanner, -RemoveDefinitions through -SignatureUpdate, the Group Policy cleanup, and leaving Tamper Protection on — is identical on Windows 10. The commands, the folder paths, and the service names don't change between the two operating systems for this particular problem.
⚠️ The honest Windows 10 line
Windows 10 reached the end of free security updates on October 14, 2025. The steps in this post still work — Defender itself keeps getting updates through the Microsoft Malware Protection Center feed regardless of Windows 10's own support status — but the rest of the operating system around it isn't getting patched unless you're enrolled in Extended Security Updates (ESU). Consumer ESU is still open to enroll as of this writing, through Settings > Windows Update, requires a Microsoft account and Windows 10 version 22H2, and costs either nothing (if you sync settings through Windows Backup), 1,000 Microsoft Rewards points, or a one-time roughly $30. Coverage was extended in mid-2026 and now runs to October 2027 for enrolled devices. If a broken threat service was the push you needed to finally move to Windows 11, that's not a bad reason.
When "Restart it now" throws a second error
"Unexpected error. Sorry, we ran into a problem. Please try again" is not a separate bug from the one you started with — it's the Windows Security app failing to start the same broken service, just reported through a different dialog. Documenting what each failure looks like matters more than a generic "try restarting your PC," because the symptom tells you where to look:
| What you see | Most likely cause | Where to look |
|---|---|---|
| "Threat service has stopped," clicking Restart does nothing | WinDefend or SecurityHealthService stopped/disabled |
Two-minute triage above |
| "Unexpected error" after clicking Restart | Corrupted platform files or definitions | -RemoveDefinitions / -ResetPlatform steps above |
WdFilter or WdBoot won't stay running |
A driver conflict, often from third-party security software | Uninstall other antivirus, then re-run the platform reset |
| "Your IT administrator has limited access to some areas of this app" | Leftover work/school Group Policy on a now-personal PC | Group Policy cleanup step above |
| Whole "Virus & threat protection" tab missing | Active malware interfering with the app, not just the service | Run Microsoft Safety Scanner before anything else |
The third-party antivirus angle, honestly
Installing another antivirus is the single most common reason Windows Defender turns itself off on purpose, not by accident — Windows is designed to yield to a real-time antivirus you chose deliberately, so it doesn't run two products fighting over the same files. That's expected behavior, not the "threat service" error, and you'll see it as Defender simply showing as inactive rather than displaying a red X.
The error you're actually troubleshooting shows up when that handoff goes wrong: the other antivirus was removed, and Defender never got the memo, or the other antivirus is still partially installed with orphaned drivers still claiming the slot Defender needs. Uninstalling the leftover product cleanly, then running the platform reset from the Windows 11 section above, resolves this far more often than any registry edit does.
When malware is actually the cause
Some malware families disable Defender deliberately, on the sound theory that an antivirus that can't run can't catch you. If you never installed another antivirus, never removed one, and never touched Group Policy, and the threat service still won't start after a platform reset, treat that as a real signal rather than a coincidence. Windows records this: the Windows Defender – Operational event log can show Event 5007 ("the configuration of Microsoft Defender Antivirus changed... it might be the result of malware") and Event 5001 (real-time protection disabled), and it's worth opening Event Viewer and checking that log for both before you conclude the fix worked.
✅ Why this is the one to use
Ethan's rule for Jake's shop: run Microsoft Safety Scanner before touching the registry or the service list, not after. If it's malware, every other fix here will hold for exactly one reboot before the malware turns Defender back off again — clearing the cause first is what makes the rest of this list actually stick.
This is also the moment to think about what else that malware may have touched — saved passwords, browser sessions, anything synced to accounts on that machine. It's a different failure mode entirely, but if you've never checked whether any of your own logins have shown up in a public breach, this breakdown of what the "16 billion passwords" breach story actually was is worth reading once your antivirus is back up — it's the kind of thing that matters more when your machine has just proven it can be compromised.
Why the popular registry fix doesn't stick anymore
You'll find this fix everywhere: open Registry Editor (regedit — the tool for viewing and changing low-level Windows settings), go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender, and set a DWORD value called DisableAntiSpyware to 0 (or, in the "turn it off" version of the advice, to 1). It's popular because it used to work.
Microsoft's own documentation for this setting is direct about its current status: it describes DisableAntiSpyware as a legacy setting, no longer necessary because Defender turns itself off automatically when it detects another antivirus, and states plainly that this setting is protected by Tamper Protection, which is on by default for consumer devices. The equivalent Group Policy setting — Turn off Microsoft Defender Antivirus, under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus — is protected the same way; changes to tamper-protected settings are ignored while Tamper Protection is active, and Group Policy itself can't turn Tamper Protection off.
So when someone reports "I set the DWORD to 1 (or 0) and it didn't change anything, or it reverted after restart" — that's not the fix failing to work. That's Tamper Protection doing exactly what it's designed to do.
If you genuinely want to turn off real-time protection
Not everyone asking about a stopped threat service wants it fixed — some people are running a different antivirus already and just want Defender's own real-time scanning to stop interfering, without a permanent registry change fighting Tamper Protection every step of the way. There's a supported way to do this temporarily, built for exactly this: open Windows Security > Virus & threat protection > Manage settings, and toggle Real-time protection off. It reverts on its own after a short period (and immediately if Tamper Protection is on and something tries to make it permanent), which is intentional — a Windows PC isn't meant to go unprotected indefinitely without you actively choosing that each time.
♂️ Jake's Reality Check
"I lost a Saturday afternoon to a customer's laptop because I assumed the red X meant it was already infected and started backing everything up before I even checked the services list."
That instinct isn't wrong, it's just early. Back up first if the machine matters, always — but check the service status and run the Safety Scanner before assuming the worst. Most of the time the machine isn't compromised; a service just didn't start.
Managed PCs, VMs, and other edge cases
If a laptop was ever joined to a work or school account — even briefly, even if it's now fully personal — leftover Group Policy from that organization can be the real cause, and it's the one that produces the extra message "Your IT administrator has limited access to some areas of this app." The Group Policy cleanup step in the Windows 11 section above addresses this, but if the PC is still actually managed by an organization, that's deliberate, and the fix is to contact whoever administers it rather than remove the policy yourself.
Inside a virtual machine, the same services and commands apply, but nested virtualization or a hypervisor's own security layer can occasionally interfere with WdFilter specifically, since it's a filesystem filter driver. If the platform reset doesn't hold inside a VM and it does hold on physical hardware, that's the direction to investigate next, rather than repeating the same reset.
Every method, in order
| Method | Works on Home? | Use it when |
|---|---|---|
| Check services in PowerShell | Yes | Always — do this first, every time |
| Microsoft Safety Scanner | Yes | Before any repair steps, to rule out malware as the cause |
| Uninstall leftover third-party antivirus | Yes | You installed or trialed another antivirus recently |
MpCmdRun.exe platform reset |
Yes | Services look wrong, no other antivirus is present, scan came back clean |
| Remove leftover Group Policy | Yes (via registry, no gpedit.msc) |
PC was ever work/school-managed |
DisableAntiSpyware registry edit |
Blocked by Tamper Protection | Never recommended — kept here only so you know why it fails |
Answers to the questions this leaves you with
What does "Threat service has stopped" actually mean?
It means one of the background services Microsoft Defender Antivirus needs — most often WinDefend or SecurityHealthService — isn't running, so the Virus & threat protection tile can't confirm your PC is being actively scanned.
Is my PC infected if I see this error?
Not necessarily. It's frequently a leftover from installing or removing another antivirus, or a corrupted Defender platform file. Malware disabling Defender is a real cause, but not the most common one — run Microsoft Safety Scanner to check rather than assuming either way.
Why doesn't clicking "Restart it now" fix it?
The button asks Windows to start the same service that's already failing to start, without addressing why it's failing. If the underlying cause is a corrupted platform file or a policy holding it off, retrying just reproduces the failure — sometimes as a second message, "Unexpected error."
What is WinDefend, and why does it matter?
WinDefend is the internal Windows service name for Microsoft Defender Antivirus Service — the one that actually runs the antivirus engine. It's the service most likely to be stopped when this error appears, and checking its status is the first diagnostic step.
Does uninstalling third-party antivirus fix it automatically?
Usually not by itself. Uninstalling the other product removes the reason Defender was off, but Defender doesn't always turn itself back on cleanly afterward — you typically still need the MpCmdRun.exe platform reset described above.
Can I just turn off Tamper Protection to fix it faster?
You can, but it removes the safeguard that stops malware — or a bad registry edit — from disabling Defender permanently. It doesn't fix the actual cause and it's easy to forget to turn back on. Leave it on and fix the service instead.
Why doesn't the DisableAntiSpyware registry fix work anymore?
Since Windows 10 version 1903, Tamper Protection has shipped on by default for consumer devices and is specifically built to ignore or revert that value. The fix isn't broken — it's being actively blocked on purpose.
What if Microsoft Safety Scanner finds nothing?
Then malware is unlikely to be the cause, and you should move on to the platform reset and Group Policy cleanup steps — a clean scan doesn't mean the service problem is solved, just that it isn't malware causing it.
Is "Unexpected error. Sorry, we ran into a problem" a different issue?
No — it's the same underlying service failure, surfaced through a different dialog when the app's own retry attempt also fails. Treat it as the same problem and continue with the service-check and platform-reset steps.
Does this happen on Windows 10 too, or only Windows 11?
Both. The services, the commands, and the causes are identical on Windows 10 and Windows 11 — only the surrounding menus differ slightly.
Can I use MpCmdRun -ResetPlatform if I'm not tech-savvy?
Yes — it's a documented Microsoft command, not an unofficial workaround, and it doesn't touch your personal files. Type the commands exactly as shown in an elevated Command Prompt, in order, and don't interrupt the sequence partway through.
What if WdFilter or WdBoot won't start no matter what?
That points to a driver-level conflict, most often from another security product's own filter driver still loaded. Confirm no other antivirus or endpoint-security software is installed, then repeat the platform reset — if it still won't hold, that's a sign the issue sits deeper than Defender itself.
Will resetting the platform delete my files or settings?
No. It removes and re-downloads Defender's own definitions and engine files, and resets Defender's configuration to default — it doesn't touch your personal files, apps, or Windows settings outside of Defender itself.
Is my PC unprotected while the threat service is down?
Yes, for real-time scanning specifically. If you can't fix it immediately and the PC is genuinely unprotected — no other antivirus installed — avoid opening unfamiliar attachments or USB drives until it's resolved.
Can a work or school account cause this on a personal PC?
Yes, if the PC was ever joined to an organization's management, leftover Group Policy from that account can hold Defender settings even after the PC is fully personal again — this is the cause behind the "Your IT administrator has limited access" message specifically.
How do I turn off "threat management" if I use a different antivirus?
Use Windows Security > Virus & threat protection > Manage settings and toggle real-time protection off there, rather than editing the registry or Group Policy. It's the supported, temporary way to step Defender aside, and it's designed to respect Tamper Protection instead of fighting it.
- The "16 billion passwords" story, explained
Worth a read once your antivirus is back up — a good reminder of what a real compromise looks like versus a scary headline.
Revision note. Written September 2026, covering Windows 11 and Windows 10 , including the current consumer ESU terms and Tamper Protection's default-on behavior since Windows 10 version 1903. This will need a revisit if Microsoft changes how MpCmdRun.exe's reset commands work or moves Tamper Protection's location again in a future Windows release, so refer latest details on MS website if not worked or let me know through contact us page, i will check and update. If you found this page at 11pm with a customer waiting or a deadline looming, take a breath — this one almost never means what the red X makes it feel like.