The Windows Defender Advanced Threat Protection service is a critical security component in Windows. When this service fails to start, your system becomes vulnerable to advanced threats and malware, as real-time protection and monitoring are disabled. You may have noticed that when you try to start it manually from the Services Manager, you ar unable to start Windows Defender Advanced Threat Protection Service. In this post, we will discuss this issue and explore potential solutions to resolve it.
The Windows Defender Advanced Threat Protection Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.
Unable to start Windows Defender Advanced Threat Protection Service
This problem typically occurs when a third-party antivirus conflicts with or disables Defender, or due to corrupted system files that break the service. It can also be caused by Group Policy settings explicitly turning off Defender, outdated platform components, or corrupted registry entries that prevent the service from initializing properly.
If you are unable to start the Windows Defender Advanced Threat Protection Service in Windows 11/10, follow the solutions mentioned below.
- Check Group Policy
- Enable via Windows Registry
- Reset with Microsoft Defender Platform
- Perform a Clean Boot to isolate Software Conflict
- Check for a Corrupted Filter Driver
Windows Defender Advanced Threat Protection Service service on Local Computer started and then stopped
1] Check Group Policy
The Group Policy Editor controls system settings that override user choices. If you set the policy to Enabled to turn off Windows Defender, it will disable the service. If you change it to Not Configured or Disabled, the restriction is removed, allowing Windows to start and manage the Defender service normally. To make the changes, you need to first open the Group Policy Editor and then go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. Look for Turn off Microsoft Defender Antivirus, double-click on it, and make sure to set it to Not Configured or Disabled. Once done, click OK.
2] Enable via Windows Registry
The Windows Registry is the underlying database where Group Policy and other system settings are stored. Since Group Policy Editor is not available on Windows Home machines, we can make changes using the Registry Editor. The DisableAntiSpyware registry value is a direct instruction to turn off Defender. Setting its value to 0 removes this disabled command at the most fundamental level, allowing the service to start. Before making any changes, you need to create a backup of the Registry.
First, open Registry Editor, and then go to the following location.
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
If a DWORD value named DisableAntiSpyware exists, double-click it and set its value to 0. If it doesn’t exist, the policy is not active.
3] Reset with Microsoft Defender Platform
We need to force the Defender platform to reinitialize and reinstall its core components. The command re-downloads and replaces the essential security intelligence and engine files from Microsoft. This fixes the service by replacing corrupted or outdated modules with clean, updated versions. Open Command Prompt or PowerShell as an Administrator. Type the following command and press Enter:
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ResetPlatform
Finally, check if the issue is resolved.
4] Perform a Clean Boot to isolate Software Conflict
We can perform a Clean Boot to isolate software conflicts. If the service starts successfully, you know a background program or service was causing the crash. So, go ahead and perform a Clean Boot. You need to try to start the service now. Hopefully, it will do the job for you.
Related read: How to set up Windows Defender Advanced Threat Protection (ATP) on Windows Server.
5] Check for a Corrupted Filter Driver
The Windows Defender service is dependent on its core filter driver (wdfilter) to function. If this low-level driver is corrupted or missing, the main service starts but has no critical component to communicate with, causing it to crash immediately. Resetting the platform and repairing system files replaces the corrupted driver, allowing the service to run properly.
Open Command Prompt as an administrator and then run the following command.
sc query wdfilter
Finally, check if the issue is resolved.
Running the System File Checker and the DISM Tool can also be considered.
Read: Threat Service has stopped in Windows Defender
Windows Defender Advanced Threat Protection Service is Disabled
The service is often disabled by group policy or manual configuration; to resolve this, open Services.msc, locate the Windows Defender Advanced Threat Protection Service, set its Startup Type to “Automatic,” and start the service. If you are unable to enable it, follow the solution mentioned above to resolve this issue.
How to fix Windows Defender cannot be started?
To fix Windows Defender not starting, first disable any third-party antivirus software that may be conflicting with it. Then, run a full system repair by executing the “%ProgramFiles%\Windows Defender\MpCmdRun.exe” -ResetPlatform command in an elevated Command Prompt. Finally, ensure the core service is set to start automatically by checking the WinDefend entry in Services (services.msc).
Read: Can’t turn on Windows Defender in Windows 11
How to disable Windows Defender Advanced Threat protection Service?
To disable the Windows Defender Advanced Threat Protection Service, open Services (services.msc), find the service, open its Properties, set the Startup type to “Disabled”, and click OK to save changes.
