Windows Defender The Threat Service has stopped in Windows 10

Sometimes, when trying to run Windows Defender, you may see this message The Threat Service has stopped, Restart it now. If you click on the Restart now button, and the Service starts, and the message disappears, well and good! But if it does not and you instead see a message Unexpected error, Sorry, we ran into a problem displayed, then here’s what you can try to fix the issue on your Windows 10.

The Threat Service has stopped

1] Ensure that Windows Defender Services are started

The Windows Defender Advanced Threat Protection service helps protect against advanced threats by monitoring and reporting security events that happen on the computer. You need to ensure that this and other required Services are set to their default values and started.

Open Windows Services Manager and locate the following Services and ensure that their Startup type is set to their default values:

• Windows Defender Advanced Threat Protection Service – Manual
• Windows Defender Antivirus Network Inspection Service – Manual
• Windows Defender Antivirus Service – Manual
• Windows Defender Firewall Service – Automatic.

You may right-click on each of them and select Start to start the Service.

To change the Staup types, you have to double-click on the Services and select the correct option from the drop-down menu of Startup type, in its Properties box.

When found, double-click on each of the services and set up their Startup type to Automatic and click on the Start if the services are not already running.

Click on the Apply and then OK and see if this has helped.

2] Edit the Registry

If the above method did not help, try this.

Run regedit to open theRegistry Editor and go to the following path –

If the DisableAntiVirus and DisableAntiSpyware DWORDs are present in the right pane, change the value to 0.

If they are not present, then create the two DWORDs and give them a value of 0 each. To do this, in the right pane, right-click on an empty spot, select New > DWORD, name them as mentioned above. Then double-click on them and give them each a value of 0.

This should help!

Date: January 22, 2019 Tags: Windows Defender

This program’s service has stopped Windows Defender error

• Microsoft Windows Defender is Microsoft’s built-in gift to its users and it is designed to protect computers from viruses, spyware and other forms of malware.
• The tool generally works smoothly, but every now and then it has the tendency to stop running.
• One of the frequent errors related to Microsoft Windows Defender is: This program’s service has stopped. Check out our solutions below to fix it in no time.
• Although it provides good protection, cyber threats today are fierce, so we advise you to install a third party antivirus as well. Make sure to check our top picks before purchasing a security software.

The This program’s service has stopped error on Windows Defender is an occasional nuisance for every Windows 10 users. If you’re getting this error, it means that Windows Defender is not running smoothly, or isn’t running at all. Needless to say, this leaves your computer vulnerable to malware, which is why you need to fix it immediately.

Before we dive into the solutions, let’s take a look at the full error message. Depending on the version of your Windows, you should be getting either one of these two errors:

Windows Defender: This program’s service has stopped. You can start the service manually or restart your computer, which will start the service. (Error Code: 0x800106ba)

This program is turned off. If you are using another program that checks for harmful or unwanted software, use the Action Center to check that program’s status.

Like the error suggests, the quickest and easiest way to resolve the problem could be restarting your computer. However, if the problem persists even after you restart your PC, you can try one of the following solutions.

How to fix This program’s service has stopped error?

1. Turn On Windows Defender Service

Well, the error message reads that Windows Defender has stopped. So, the first thing you should try is to manually turn it back on. You will need to do this via the Windows Services Manager. Follow these steps:

1. Press Windows + R to open the Run dialogue.
2. Type in services.msc and press Enter.
3. Find the following services in the list of services:
   • Windows Defender Advanced Threat Protection Service
   • Windows Defender Antivirus Network Inspection Service
   • Windows Defender Antivirus Service
   • Windows Defender Security Center Service
4. For each of these services the status should be Running (check the status column) and their Startup type should be set to Automatic.
5. If this isn’t true for any of the services, double click on it to view its Properties. Change the Startup type to Automatic.
6. Now, click on the Start button and click Apply.
7. Check if Windows Defender is up and running again. If the problem persists, try the next step.

2. Disable all third-party anti-malware software

One of the most common reasons for getting the This program’s service has stopped error is due to third-party anti-malware software. Windows Defender tends to stop itself every time it receives a signal from these third-party programmes. So the reason you’re getting this error could either be that or some internal error. To verify, try disabling all third-party anti-malware applications and see if this resolves the problem.

If doing this solves your problem, you may have to re-install the third-party application. If not, move on to the next step.

3. Verifying Group Policy Editor settings

You could have accidentally turned off Windows Defender when using the Group Policy Editor. Also, a malware could have accessed the Group Policy Editor and done so. To verify this, try these steps:

1. Go to Start, type gpedit.msc, and press enter.
2. This should open the Local Group Policy Editor; navigate to this path:
   • Computer Configuration > Administrator Templates > Windows Components > Windows Defender Antivirus
3. If you see an option called Turn off Windows Defender Antivirus on the right hand side, go ahead and double-click on it.
4. If this is set to Enabled, change it to Not Configured.
5. Check if Windows Defender is up and running again. If not, proceed to the next step.

4. Verify Registry Editor settings

Sometimes, malware can change a Register key belonging to the Windows Defender service. This could be one of the reasons you’re getting the This program’s service has stopped error. To verify this, try these steps:

1. Press Windows + R to open the Run dialogue.
2. Type in Regedit and press Enter.
3. Navigate to this path:
   • HKey_Local_MachineSoftwarePoliciesMicrosoftWindows Defender
4. If you see a key called DisableAntiSpyware on the right hand side, either delete it or set its value to 0.
5. Check if Windows Defender is up and running again. If not, proceed on to the next step.

5. Re-register Windows Defender related DLL files

Occasionally, re-registering the Windows Defender related DLL files can also resolve the issues. To do this, follow these steps.

1. Go to Start, and type Command Prompt.
2. Select Command Prompt with administrative privilege.
3. Run these commands:
   • regsvr32 atl.dll
   • regsvr32 wuapi.dll
   • regsvr32 softpub.dll
   • regsvr32 mssip32.dll
4. Check if Windows Defender is up and running again.

We are confident that these solutions can have a positive outcome when it comes to resuscitating Windows Defender. Have you ever faced this error? If such is the case, don’t be shy to share your experience and any other possible solutions by hitting the comments section below.

Windows defender: «Threat service has stopped»

It does not restart.. but I do not use any antivirus. How can I solve this

Moved from Windows

Some users might be experiencing a glitch with starting the Threat Service (Windows Defender Antimalware Service) that was apparently delivered on Patch Tuesday. The first thing to try would be manually restarting the PC lots of times, with a break between the restarts (Start button > Power > Restart), as described by Le Boule in this thread:

This issue might also be related to the known glitch where the Security Center Service needs to be restarted in order to get Windows Defender up and running – so try this:

• Manually restart the Security Center, and then attempt to start the Windows Defender Antivirus Service:

1. Press Win Key + R

2. Type “services.msc” and click OK.

3. Right-click on Security Center and click Restart

3. Right-click on the Windows Defender Antivirus Service and click Start.

If that doesn’t work, t hen you should follow these general troubleshooting steps:

• Remove any undetected malware by scanning with several third-party malware-removal apps, starting with Malwarebytes Free:

• Run the cleanup tools for any previously installed or preinstalled AV apps:

• Run the standard Windows 10 system integrity checks:

If the above steps fail to start the Windows Defender Antivirus Service, then you can try the steps provided here:

I hadn’t noticed that PrashantKumar96 actually advised setting DisableAntiSpyware = 0 in this forum article. Before you do that, you should always try just deleting any possible entry for DisableAntiSpyware = 1, since that setting might have been added by another program or by malware – and that setting will always prevent Windows Defender from starting. For the sake of both ease and safety, this should be done with a REG command.

Type “cmd” in the search box; and then right-click on Command Prompt and select Run as administrator .

And then copy, paste, and enter this command:

REG DELETE «HKLM\SOFTWARE\Policies\Microsoft\Windows Defender» /v DisableAntiSpyware

This is the proper way to enable Windows Defender when it’s been turned off via Group Policy.

We can see that there’s a general confusion with respect to this Group Policy setting by the way that Brink equivocates deleting the DisableAntiSpyware entry with setting its value to 0.

DisableAntiSpyware DWORD

(delete) or 0 = On
1 = Off

But this setting actually uses a three-state logic, where the absence of the setting specifies the normal Automatic Disabled compatibility mode for Windows Defender. Setting DisableAntiSpyware = 0 sets Windows Defender’s operational state to “always on” [DisableAntiSpyware = 0 (logical “no/never”)], whereas [DisableAntiSpyware = 1 (logical “yes/always”)] sets Defender’s operational state to “always off”; and where removing the DisableAntispyware registry entry simply returns Defender to its default operational state – where Defender will be automatically disabled by the installation of any third-party AV app, and automatically enabled when a third-party AV app is uninstalled.

As the «method of last resort», you can set the Group Policy for Windows Defender to its “always on” mode:

Type “cmd” in the search box; and then right-click on Command Prompt and select Run as administrator.

And then copy, paste, and enter this command:

REG ADD «HKLM\SOFTWARE\Policies\Microsoft\Windows Defender» /v DisableAntiSpyware /t REG_DWORD /d 0 /f

Then click the Restart button (it might be necessary to restart the PC first).

If this doesn’t work, then you should remove this setting with the REG DELETE command provided above. Note that this REG ADD command is just the safe and easy way to perform the registry edit that was described in the answer to this thread:

No internet-connected PC is safe when it’s running without real-time protection. So if you’re not able to restart the Windows Defender Antivirus Service, then the best course of action would be to just temporarily install a free third-party AV solution until we can get a handle on things. Replacing Defender with a third-party AV app should at least provide you with a viable alternative for Defender’s real-time protection, and thus let you safely connect to the internet:

Temporarily Stop All Microsoft Windows Defender Processes In Windows 10

I’m running a huge sync job and Microsoft Windows Defender is hogging a ton of memory and creating a lot of disk I/O requests on my drive as well.

I know how to disable Windows Defender but I do not want to reboot my PC while this sync in going on to disable it. I also turned off real-time protection but that did not accomplish freeing the memory up like I expected. I really just need to stop the MsMpEng.exe application.

Is it possible to temporarily stop Windows Defender application and then start it again without needing to reboot the PC?

1 Answer 1

A Step-by-Step Guide to Temporarily Disabling Windows Defender and then Re-Enabling it on Windows 10

Initial One-Time Setup #1 — #4 per PC

1. Make a Windows Defender Folder Exclusion

First to start, create a new folder on your «C» drive or somewhere you can access and name it DefenderExclusions.

Press the Windows Key one time, start typing «Windows Defender» and click it once you see it.

From Windows Defender click on Settings

Go to Windows Defender and in the Exclusions area click the «Add an exclusion option»

• Click the «Exclude a folder» option

• Select the DefenderExclusions folder location you created above when the Select Folder window opens and then select the «Exclude this folder» option

Download the NoDefender App and it should save as a zip file named NoDefender.zip.

Open the NoDefender.zip file and then right-click and select Copy on the file within it named NoDefender.exe

Go to the DefenderExclusions folder location you created and setup the Windows Defender Exclusion, right-click and then paste to save the NoDefender.exe into this folder.

3. Create Disable Defender Script

• Save the below logic to a text document in the DefenderExclusions and name it to DisableDefender.cmd

DisableDefender.cmd Script

4. Create Enable Defender Script

• Save the below logic to a text document in the DefenderExclusions and name it to EnableDefender.cmd

EnableDefender.cmd Script

Disabling Windows Defender

Double-click the DisableDefender.cmd batch file saved in the DefenderExclusions location setup previously.

When Windows Defender opens, click on the Settings option and be sure the Windows Defender option is selected on the left.

Turn offReal-Time Protection, Cloud-based Protection, and the Automatic sample submission options.

It is expected to see the warning message pop up in the lower right-hand corner of the task bar indicating that Spyware and unwanted software protection may be disabled with the red X.

You will notice the Windows Defender app screen is more red than green now, the PC Status: At risk is showing, and the Real-time protection is off; just minimize that window for now.

Double-click the NoDefender.exe file previously saved in the DefenderExclusions location. If the User Account Control message pops up select the Yes option to run it

Select Next in the NoDefender app window

Select Next again in the NoDefender app window

Click on the Disable Window Defender option in the NoDefender app window and then select the Next option.

You should then see the NoDefender app window saying it’s Done and that Window Defender should be disabled, select the Exit option.

Now if you go back to the Windows Defender app window, you should notice that the Virus and spyware definitions with an Out of date status

Now it is time to run the process(es) or whatever that needs to run with Windows Defender being disabled. Let everything finish and then once you are ready to re-enable Windows Defender, follow the Enabling Windows Defender section below.

Enabling Windows Defender

Double-click the EnableDefender.cmd batch file saved in the DefenderExclusions location setup previously and give it a few seconds to finish and pop up the Windows Defender app window.

When the Windows Defender app window opens you should notice the Real-time protection is On and the Virus and spyware definitions have a value of Up to date now.

You want to select the Settings option from the Windows Defender app window again.

Turn On Real-Time Protection, Cloud-based Protection, and the Automatic sample submission options.

Now Windows Defender is re-enabled again.

As per the comment:

The point of this question was to actually start the application over again causing it to release it’s hold on all the memory it has consumed. I have used registry entries that will stop the WD application from running but that requires a reboot. I disable WD (real-time protection) by just going into settings and turning off real-time protection. If real-time protection is off WD is disabled, if MsMpEng.exe is not running, WD is stopped. – Arvo Bowen

Testing Results of MsMpEng.exe Before and After Running the Process

Below is a screen shot of the results of the command line of tasklist | FIND /I «ms» which shows whether or not the MsMpEng.exe process is running in memory. This process appears to kill the process from memory when it’s disabled, and it appears to have it start back up and running in memory when it’s enabled.

As per the comment:

OK so following these steps SOME of the results are true. 1) When I click the «Disable Windows Defender» button, WD has two messages (real-time and Antivirus protection) is turned off. After two seconds the Antivirus message disappears and only the real-time is left. Also, Virus and spyware definitions still show up to date (green check). – Arvo Bowen