How to Fix “Threat Service Has Stopped” in Windows Defender

“Threat service has stopped. Restart it now.” is a common message that appears in Windows Defender (also known as Windows Security) on Windows 10 and 11. This issue prevents the built-in antivirus from running scans or protecting your system, and often persists even after clicking the Restart now button. The error can be triggered by system file corruption, broken registry entries, third-party antivirus conflicts, or Windows updates. Below, you’ll find effective methods to restore Windows Defender’s threat protection service and get your PC’s security back on track.

Restore Windows Defender Services via Registry Repair

Misconfigured or missing registry entries for Windows Defender frequently cause the threat service to stop. Correcting these entries can reactivate the service and restore full antivirus functionality.

Open the Registry Editor by pressing Win + R, typing regedit, and pressing Enter. Click Yes if prompted by User Account Control.

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. Check for the entries DisableAntiVirus and DisableAntiSpyware in the right pane. If they exist, double-click each and set their value data to 0.

If either entry is missing, right-click an empty area, choose New > DWORD (32-bit) Value, name it accordingly, and set the value data to 0.

Next, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend. Double-click the Start entry in the right pane and set its value data to 2 (which means “Automatic”).

Close the Registry Editor and restart your PC. Open Windows Security to check if the threat service is running.

Enable Windows Defender Services Using the Services Console

Windows Defender relies on several background services. If any are disabled or stopped, the threat service error appears.

Press Win + R, type services.msc, and press Enter to open the Services console.

Locate the following services:

Windows Defender Antivirus Service
Windows Defender Advanced Threat Protection Service
Windows Defender Antivirus Network Inspection Service
Windows Defender Firewall

Double-click each service. Set the Startup type to Manual (or Automatic for Windows Defender Firewall) and click Start if the service is not running. Click OK to save changes.

Restart your computer and verify if Windows Defender’s threat service is restored.

Remove Conflicting Third-Party Antivirus Software

Windows Defender automatically disables itself when another antivirus product is installed. If you see the “threat service has stopped” message, check for any third-party security software.

Open Control Panel and select the Programs and Features category.

Find and uninstall any antivirus programs (such as Panda, Avast, Norton, etc.).

After uninstalling, restart your PC. Windows Defender should reactivate and the threat service should run as normal.

Note: Some antivirus products require a dedicated removal tool for complete uninstallation. Visit the software vendor’s website if the standard uninstall fails.

Repair System Files with SFC and DISM

Corrupted Windows system files can disrupt Defender’s services. Running the System File Checker and Deployment Imaging Service Management Tool can repair these files.

Open the Command Prompt as an administrator by searching cmd, right-clicking it, and choosing Run as administrator.

Type the following command and press Enter:

sfc /scannow

This command scans for and repairs corrupted system files. Wait for the process to complete.

After SFC finishes, type the next command to repair Windows image files:

Dism.exe /Online /Cleanup-Image /Restorehealth

Let the process finish, then restart your PC. Check if the Defender threat service is working.

Update Windows and Defender Definitions

Windows updates or outdated Defender definitions can cause the service to stop. Applying the latest updates can fix service crashes or bugs introduced by previous patches.

Open Settings (Win + I) and go to Update & Security > Windows Update.

Click Check for updates and install any available updates, especially those related to Windows Defender or security intelligence updates.

Restart your PC after updates are installed. Open Windows Security to verify if the threat service is running.

Repair Windows with an In-Place Upgrade

If none of the above solutions work, performing an in-place upgrade reinstalls Windows system files without deleting your personal data or installed apps. This approach often repairs persistent Defender service issues caused by deep system corruption.

Download the official Media Creation Tool from Microsoft’s website for your Windows version.

Run the tool and select Upgrade this PC now. Follow the on-screen instructions, choosing to keep personal files and applications when prompted.

Allow the upgrade process to complete. After the system restarts, check if Windows Defender’s threat service is operational.

Tip: Back up important files before proceeding with an in-place upgrade to avoid accidental data loss.

Addressing the “Threat service has stopped. Restart it now.” error in Windows Defender usually involves restoring registry settings, enabling required services, removing conflicting antivirus software, or repairing system files. If the problem persists, a system upgrade can restore full Defender protection and keep your PC secure.