Microsoft Defender status: how to check protection

To check whether Microsoft Defender is on, open Windows Security and look at the status on the home screen. If it says `No action needed`, Defender is usually running normally. If you see `Attention needed`, a warning, or the app won’t open, something needs a closer look.

Where to check Microsoft Defender status first

The fastest place to check is the Windows Security app.

1. Open Start and search for Windows Security, then open it.
2. On the home screen, look at the main status message and the protection tiles such as Virus & threat protection.
3. Open Virus & threat protection if you want to check whether real-time protection is on and whether security intelligence updates are current.

The exact labels can vary a bit by Windows version and by the Defender edition on your PC. Green or normal status usually means protection is active, while yellow or red usually means something needs attention.

What the status labels usually mean

Here’s the usual meaning of the messages you may see in Windows Security:

• No action needed usually means Defender is running normally and Windows does not see a problem that needs your attention.
• Attention needed usually means something is turned off, out of date, or blocked by another setting or security product.
• A warning, yellow icon, or red icon usually means protection is not fully healthy right now and you should open the related protection area to see what changed.
• Turn on or Protection is off usually means a protection feature is disabled.
• If the app says updates are needed, Defender may still be present, but its definitions may not be current enough to recognize the latest threats.

If the home screen and the detailed protection page disagree, trust the specific protection area. For example, Virus & threat protection can show that definitions need updating or that real-time protection was interrupted even when the home page looks fine.

How to tell whether real-time protection and updates are working

Check these two things inside Virus & threat protection:

• Real-time protection should show as on, or at least not show a warning that it is off.
• Protection updates should be current, or Windows Security should show that it checked successfully.

If either one looks off, Defender may be installed but not fully protecting the device right now. The app may also show a message about another antivirus taking over, which can happen when a third-party security suite is installed.

If Defender looks off or won’t open

Check the simplest causes first, in this order.

1. Open Windows Security and go to Virus & threat protection.
2. Look for a message about protection status, updates, or a button to turn protection back on.
3. Check Protection updates and install the latest security intelligence if Windows offers it.
4. Open Manage providers or the security app’s protection details and see whether another antivirus is installed and taking over. On many PCs, a third-party antivirus disables parts of Defender so the two do not conflict.
5. Restart the PC if the status looks stuck after an update or a settings change.
6. If Windows Security will not open, use Windows Update to make sure the operating system itself is current, then try again.

If the app still will not open after that, the cause may be a work or school policy, a third-party security suite, or a damaged Windows Security app. The exact fix depends on your Windows version and the message you see.

How to confirm everything is back to normal

You’ll know Defender is back to normal when these signs line up:

• Windows Security opens normally.
• The main status message shows no warning.
• Virus & threat protection shows real-time protection as on, or at least no alert that it is off.
• Protection updates are current, or the app says it checked successfully.
• No yellow or red warning remains on the Windows Security home screen.
• No other antivirus is reporting a conflict or taking over unexpectedly.

If those checks line up, Defender is usually active and protecting the device again.