Fix Windows Defender ATP Service Disabled in Windows 11

Windows Defender Advanced Threat Protection (ATP), now known as Microsoft Defender for Endpoint, is a critical component of Windows 11 security. It offers real-time protection against a wide variety of cyber threats. However, some users experience an issue where the Windows Defender ATP service becomes disabled, leaving their system vulnerable. This can be a serious concern, particularly for business or enterprise users who rely on continuous endpoint protection.

In this article, we discuss how to identify, troubleshoot, and fix the issue of Windows Defender ATP service being disabled in Windows 11. The steps below are written with clarity and caution to ensure you do not mistakenly disable other key features of your system.

Understanding the Problem

There are a number of reasons why Windows Defender ATP might be disabled:

• Conflicts with third-party antivirus software
• Group Policy misconfigurations
• Damaged Windows system files
• Registry errors
• Service dependencies not running

Before taking any action, it’s essential to determine the root cause. Always ensure that you back up critical data and create a restore point before modifying system settings.

Step-by-Step Solutions

1. Check Service Status

Start by verifying if the Defender ATP service is actually disabled:

1. Press Windows + R to open the Run dialog.
2. Type services.msc and hit Enter.
3. Scroll down to Microsoft Defender Antivirus Service and Windows Defender Advanced Threat Protection Service.
4. Check their statuses – if they are marked as “Disabled”, right-click and choose Properties.
5. Set the Startup type to Automatic and click Start.

If these services are greyed out or unresponsive, continue to the next step.

2. Scan for System Integrity Issues

Corrupt system files can cause services to fail. Run the following scans:

1. Open Command Prompt as Administrator.
2. Type the following and press Enter: sfc /scannow
3. Once complete, type: DISM /Online /Cleanup-Image /RestoreHealth

Allow both processes to finish. If integrity violations are corrected, reboot your system and check the ATP service status again.

3. Uninstall Third-Party Antivirus Software

Third-party firewall or antivirus suites may conflict with Windows Defender:

• Navigate to Settings > Apps > Installed Apps.
• Uninstall any non-Microsoft security software.
• Restart your computer and check if Windows Defender ATP is re-enabled.

If you are in a corporate environment, contact your IT department before removing any enterprise-level software.

4. Modify Group Policy Settings

Defender ATP may also be disabled through local Group Policy:

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Double-click on Turn off Microsoft Defender Antivirus and ensure it is set to Not Configured or Disabled.
4. Repeat the same for Microsoft Defender Antivirus Service policies if available.

Group Policy changes could take effect after a restart or running gpupdate /force in Command Prompt.

5. Restore Registry Settings

If you’re comfortable with Registry Editor:

1. Open Regedit via Run (Windows + R).
2. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
3. Delete any keys or values like DisableAntiSpyware.
4. Exit the Registry Editor and restart your computer.

Incorrect registry edits can severely impair your OS, so only attempt this step if you are confident in your technical skills.

Final Thoughts

Windows Defender ATP provides proactive defense against evolving threats. If it becomes disabled, your system is inherently more vulnerable. Follow the steps above in order, starting from the simplest. If all else fails, consider reinstalling or repairing Windows using the Windows 11 Installer Tool.

For enterprise users, Microsoft Endpoint Manager or a similar MDM (Mobile Device Management) could be enforcing policies that disable Defender. In such cases, administrators should review their security baseline configurations.

Maintaining the integrity and functionality of Windows Defender ATP is not optional—it’s a core component of your device’s security infrastructure. Stay updated, scan regularly, and ensure that all essential services are running as expected.