FIX: Windows Defender is deactivated by Group Policy

• Is Windows Defender deactivated by Group Policy? The troubleshooting tips below will help you out.
• They involve using regedit or turning on Windows Defender by running a couple of commands.
• You can also use one of these great anti-malware software tools to quickly scan your computer.
• Whenever you need help, remember that this Windows 10 Errors Hub includes unique solutions to all your problems.

1. Download Restoro PC Repair Tool that comes with Patented Technologies (patent available here).
2. Click Start Scan to find Windows issues that could be causing PC problems.
3. Click Repair All to fix issues affecting your computer’s security and performance

• Restoro has been downloaded by 0 readers this month.

Microsoft’s built-in antivirus, Windows Defender, is used by millions of people to protect their computers.

Unfortunately, sometimes Windows Defender can’t do its job because of various errors.

One of the most common Windows Defender error messages is the following: This app is turned off by Group Policy.

This message appears if you installed another antivirus program or an anti-hacking tool that isn’t fully compatible with Microsoft’s built-in antivirus.

Windows Defender is a solid antivirus, but sometimes issues with it can occur. Speaking of Windows Defender issues, here are some problems that users reported:

• Group Policy blocks Windows Defender Windows 10 – This issue can occur on Windows 10 and even prior versions. Even if you don’t use Windows 10, you should be able to apply most of our solutions to the older versions of Windows.
• Turn Windows Defender on via Group Policy – If your Windows Defender is turned off by Group Policy, you can fix this problem with ease. Simply change a couple of values in Group Policy and Windows Defender should start working again.
• Group Policy blocks Windows Defender – If your Group Policy blocks Windows Defender, you might be able to fix the problem simply by making few changes in your registry.
• Unable to start Windows Defender Group Policy – If Windows Defender is blocked by Group Policy, you can solve the issue simply by starting Windows Defender from the Settings app.
• Windows Defender stopped by Group Policy, not working Group Policy – These are some common problems that can occur with Windows Defender, but you should be able to solve them with one of our solutions.

How can I fix This app is turned off by Group Policy error?

1. Check your PC for malware

Sometimes you can encounter this problem due to malware infection. Sometimes malware can get administrative privileges on your PC and disable Windows Defender from Group Policy.

However, you can fix that issue simply by scanning your PC with one of the best anti-malware tools that you can find. If you’re looking for such a tool, we suggest you try Malwarebytes.

It will clean your PC from malware, and it’s incredibly simple to use, so be sure to try it out. Once you remove the malware from your PC, you should be able to activate Windows Defender without any issues.

Malwarebytes

2. Consider switching to a different third-party antivirus

Windows Defender is a solid antivirus, but if you can’t fix the Windows Defender is deactivated by Group Policy message, you might want to consider switching to a third-party antivirus solution.

Unlike Windows Defender, third-party antivirus tools offer some advanced features that many users will find useful.

If you want extra security on your PC, you should consider Bitdefender Antivirus Plus. It’s the world’s nr.1 for a good reason – it offers great protection from malware.

Bitdefender Antivirus Plus

3. Make sure that old third-party antivirus tools are removed

Windows Defender is designed to turn itself off once you install a third-party antivirus. If you had a third-party antivirus on your PC, it’s possible that the issue was caused by it.

Even if you remove your antivirus, sometimes there might be some leftover files or registry entries. These files can also interfere with Windows Defender and cause this issue to appear.

To fix the problem, it’s important to remove those files from your PC. The best way to do it is to download a dedicated uninstaller for your antivirus.

If you can’t find this tool, you can also use uninstaller software. These tools will remove any leftover files and registry entries and completely remove any application from your PC.

There are many great uninstallers available, but one of the best is IOBit Uninstaller. After you remove the leftover files with this tool, you should be able to start Windows Defender without any issues.

IObit Uninstaller

4. Use redegit

1. Press Windows Key + R shortcut, type regedit and hit Enter.
   
2. Go to HKey_Local_Machine\SoftwarePolicies\Microsoft\Windows Defender
   
3. Delete the value in the DisableAntiSpyware key.

Run a System Scan to discover potential errors

More specifically, some users will see two options

1. Under type, it says – REG -DWORD
2. Under Data, it says – (invalid DWORD (32-bit) value)

Double click on the REG -DWORD and a small window will open where you can delete the value or set it to zero. If you can’t change the key value, delete the whole key.

Some users are reporting that you can fix the problem by deleting the DisableRealtimeMonitoring DWORD so you might want to try that as well.

5. Use the Group Policy

1. Log in as an administrator. Type gpedit.msc in the Search bar and hit Enter.
   
2. Go to Local Computer Policy >Administrative Templates >Windows Components >Windows Defender Antivirus. Select Windows Defender > in the right-hand panel, you’ll see the option Turn off Windows Defender Antivirus. Double-click to open it.
   
3. In the new window > select Disable > click OK to save the settings.
   

Want to use Group Policy on your Windows 10 Home edition? Find out how to get it by using this quick guide.

6. Turn on Windows Defender from the Settings app

1. Open the Settings app. You can do that quickly by using Windows Key + I shortcut.
2. When the Settings app opens, navigate to the Update & Security section.
   
3. Select Windows Defender from the menu on the left and in the right pane click Open Windows Defender Security Center.
   
4. Now select Virus & threat protection.
   
5. Navigate to Virus & threat protection settings.
   
6. Now locate Real-time protection and enable it.
   

If you’re getting a message that Windows Defender is deactivated by Group Policy, you might be able to fix the problem simply by turning it on from the Settings app.

After doing that, Windows Defender should be enabled and your PC will be protected.

If you’re having trouble opening the Setting app, take a look at this dedicated article to solve the issue.

7. Turn on Windows Defender using the command line

1. Press Windows Key + S and enter powershell. Right-click Windows PowerShell from the list and choose Run as administrator from the menu.
   
2. When PowerShell opens, enter Set-MpPreference -DisableRealtimeMonitoring 0 and press Enter.
   

If you’re an advanced user, you can fix the problem with Windows Defender is deactivated by Group Policy message simply by running a couple of commands in the command line.

This method is the fastest since it allows you to turn on or off Windows Defender in a matter of seconds. To enable Windows Defender, you just need to do as described above.

After doing that, the Windows Defender will become enabled and the issue should be resolved.

You can also use Command Prompt to enable Windows Defender. By using the Command Prompt you’ll modify your registry.

Basically, you’ll perform the same action as in Solution 1, but you’ll do it with just a single command in a matter of seconds. To do that, just follow these steps:

1. Press Windows Key + X to open Win + X menu. Now choose Command Prompt (Admin) from the list.
   
2. When Command Prompt opens, enter REG DELETE HKLMSOFTWAREPoliciesMicrosoftWindows Defender /v DisableAntiSpyware command and press Enter.
   

After doing that, the selected value will be deleted from the registry and Windows Defender should start working again.

8. Check if Windows Defender service is running

1. Press Windows Key + R and enter services.msc. Now press Enter or click OK.
   
2. A list of services will now appear. Scroll down and double-click the Windows Defender Antivirus Service to open its properties.
   
3. Set the Startup type of the service to Automatic and click the Start button to start the service. Now click Apply and OK to save changes.
   

After enabling the service, the issue should be resolved and Windows Defender will start working again.

Windows relies on certain services in order to work properly, but if there’s a problem with one of those services, you might encounter certain issues.

If you’re getting a message saying that Windows Defender is deactivated by Group Policy, the problem might be the disabled Windows Defender service.

However, you can easily enable this service and fix the problem by doing as described above.

There you go, use one of these methods and the Group Policy will no longer disable Windows Defender. If you have any more suggestions or questions, feel free to drop them in the comments section below.

Windows Defender is blocking too much saying it viruses

I’ve been getting the above message when using different software like Unity, Minecraft, Photoshop, 3ds Max, etc. For some reason the different software is being blocked by windows defender even though i have active protection off and allowed exceptions for the various software. Any help with this would be appreciated.

Replies (3) 

Based on the screenshot that you’ve provided, Controlled Folder Access is turned on, blocking most apps that you’re using. We suggest that you turn it off to allow blocked apps in Windows Defender. Follow the steps below:

1. Select Start >Settings.
2. Choose Update & security >Windows Defender.
3. Select Open Windows Defender Security Center.
4. Select Virus & threat protection, and then choose Virus & threat protection settings.
5. Under Controlled folder access, turn it on or off.
6. Once done, try accessing the apps and see if you can now access them.

Should you need further assistance, feel free to post back.

23 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

3 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

The steps provided in the reply above are taken from this Microsoft document, which unfortunately tends to appear at top of many search result lists for “Controlled Folder Access”:

After stating that “You can add an app to the list of safe or allowed apps to prevent them from being blocked”, this article goes on to provide the steps for turning off Controlled Folder Access, rather than the steps that you would actually take to “Allow a blocked app in Windows Defender Security Center” (the title of the article), so there’s a rather glaring logical disconnect in this article, and it really should be fixed.

While the proper steps to “Allow a blocked app in Windows Defender Security Center” are inexplicably missing in the article that bears that title, other Microsoft documents on this topic actually do provide the proper steps for this, e.g.:

If you see an App is blocked message when you try to use a familiar app, you can simply unblock the app. If this message displays:

1. Write down or take note of the path of the blocked app.
2. Select the message, and then select Add an allowed app.
3. Browse for the program you want to allow access.

This method should allow you to add any of your blocked apps to the default list of authorized apps (whitelist) – without opening the gate to ransomware and data-wipers by turning off Controlled Folder Access.

The file path in the Unauthorized changes blocked notification does tend to be truncated – but there’s usually enough of it there to locate the app without any trouble (it’s usually in the Program Files or Program Files (x86) directory). If the file path is truncated to the point where you can’t locate the blocked app in the Open dialog; then open Event Viewer; navigate to the Windows Defender Operational log; and locate the blocking event (Event ID 1123):

1. Right-click on the Start button and select Event Viewer.

2. Navigate to Applications and Services > Microsoft > Windows > Windows Defender > Operational

3. Filter for (or just look for): Event ID 1123

Issues with this new ransomware protection feature were fully anticipated – and that’s why it includes an Audit Mode, which allows you to monitor folder access activity without having anything blocked – so you can spend some time “learning the ropes” without having your work disrupted.

Right-click on the Start button and select Windows PowerShell (Admin); and then copy, paste, and enter this command:

Set-MpPreference -EnableControlledFolderAccess AuditMode

Issues with Adobe apps and LibreOffice are frequently reported, and it might take some time to work through these. But if you’re willing to make the effort, you might find some helpful suggestions here:

Going forward, application developers will also be providing specific information for allowing their apps, and should soon be providing help with this in their respective user forums; e.g.:

If you actually do encounter serious difficulties with whitelisting your unrecognized apps, then you might want to turn off Controlled Folder Access temporarily and “try again later” – or better yet; just make sure that all of your personal files are properly backed up on a disconnected drive, and then don’t worry about turning it back on:

Stopping ransomware where it counts: Protecting your data with Controlled folder access