Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If Microsoft Defender crashes, Windows Security closes during a scan, or a scan stops after an update, do not begin by disabling antivirus or adding exclusions. First install Windows and Defender updates, then capture the failure in Event Viewer. Those two steps usually reveal whether the problem is a stopped scan, a failed Defender service, a platform problem, or a conflict with another antivirus.
What “Defender crashing” can mean
Microsoft Defender Antivirus and the Windows Security app are related but not identical. A visible crash can be the Windows Security interface closing, a scan ending before completion, or the Defender services stopping in the background. The remedy depends on which one occurred.
As an Amazon Associate I earn from qualifying purchases.
- Windows Security closes: the interface failed, but protection services may still be running.
- A scan stops: the scan process was interrupted, possibly by a restart, an update, a damaged definition set, or a service failure.
- Protection is unavailable: one or more Defender services are not running, or Windows has disabled Defender because another compatible antivirus is active.
- Defender fails after an update: the platform or security-intelligence data may be outdated or damaged.
Use the sequence below in order. It starts with changes that are low risk and reversible, and only moves to administrative repair commands after you have collected evidence.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →1. Update Windows and Defender before repairing anything
Microsoft recommends Windows Update for continual scan errors. Defender security intelligence is normally delivered through Windows Update, but you can also request an update from Windows Security when update errors persist.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Open Settings and run Windows Update. Install all available quality, security, and Defender-related updates, then restart if Windows requests it.
- Open Windows Security.
- Select Virus & threat protection.
- Under Virus & threat protection updates, select Check for updates.
- After the update completes, run a Quick scan and note whether the application still closes or the scan still stops.
Do not judge the update by the app window alone. If the update fails, record the displayed error and the time. That timestamp will help you match the failure to an Event Viewer entry.
2. Capture the crash in Event Viewer
Event Viewer gives you a durable record instead of relying on a message that disappears when Windows Security closes. Microsoft’s documented location is Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
- Press Windows key + R, enter
eventvwr.msc, and press Enter. - Expand Applications and Services Logs, then Microsoft, Windows, and Windows Defender.
- Select Operational.
- Find entries at the exact time Windows Security closed or the scan stopped. Use Filter Current Log if the log is busy.
- Open the relevant event and save or copy both the General and Details tabs. Keep the event ID, level, provider, timestamp, and message together.
For scan activity, the important event IDs are:
| Event ID | Meaning | How to use it |
|---|---|---|
| 1000 | Scan started | Confirms that Defender began the requested scan. |
| 1001 | Scan finished | Shows a normal completion entry; compare its time with the app behavior. |
| 1002 | Scan stopped before completion | Use the surrounding events to identify what interrupted it. |
Also inspect the System log around the same time. Events 6005, 6006, 6007, and 6008 can indicate that Windows started, shut down, recovered from an unexpected shutdown, or otherwise restarted while a scan was running. A 1002 event immediately before a restart is a different problem from a scan that stops while the computer remains online.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Check whether Defender’s services are running
A closed Windows Security window does not prove that antivirus protection stopped. Check the service state before attempting a reset.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Press Windows key + R, enter
services.msc, and press Enter. - Locate each service in the table below and check its current state.
| Service | Expected state during normal operation |
|---|---|
WinDefend |
Running |
WdFilter |
Running |
WdNisSvc |
Running |
WdNisDrv |
Running |
SecurityHealthService |
Running |
wscsvc |
Running |
WdBoot |
Stopped after boot can be normal |
If the expected services are running, concentrate on the scan log and possible software conflicts rather than repeatedly starting services. If several are stopped or refuse to start, treat the problem as a service or platform failure and proceed to the conflict check and documented repair tools.
4. Remove antivirus conflicts before resetting Defender
A compatible non-Microsoft antivirus normally causes Windows to turn Microsoft Defender Antivirus off automatically. This is deliberate, because running two real-time antivirus engines can create conflicts and duplicate scanning. Microsoft’s startup guidance tells users who intend to rely on Defender to uninstall non-Microsoft antivirus software before continuing.
Check Settings > Apps > Installed apps for another antivirus product, including one left behind after a trial expired. Uninstall it using the vendor’s normal removal process, restart Windows, and check the Defender services again. If the other product is managed by an employer or school, do not remove it yourself; ask the administrator which antivirus is supposed to provide real-time protection.
Recommended Free Tools
Do not interpret a missing Defender real-time toggle as a crash until this check is complete. Windows may have disabled it because the other antivirus is active.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
5. Choose the scan mode deliberately
Windows Security offers Quick, Full, and Microsoft Defender Offline scans. They have different scope and restart behavior.
| Scan | What it does | When to choose it | Restart? |
|---|---|---|---|
| Quick scan | Checks common locations where threats are often found. | First check after updating, or a routine verification. | No restart normally required. |
| Full scan | Checks every file and program on the device. | When a Quick scan completes but you need a complete on-disk check. | Not normally required, but it can take substantially longer. |
| Microsoft Defender Offline | Uses current definitions after restarting into Windows Recovery Environment; it automatically restarts when complete. | When persistent malware may be hiding while Windows is running, or normal scans repeatedly stop. | Yes. Save work and keep the device connected to power. |
Start with Quick scan after updating. Use Full scan when you need complete coverage. Select Offline scan when the evidence suggests that a threat may be interfering with normal Windows processes. A restart during Offline scan is expected, not evidence of another crash.
6. Escalate service failures with Microsoft’s documented tools
Use this section only when updates, logs, service checks, and conflict removal have not resolved the problem. The commands below require an elevated Command Prompt or PowerShell window. An administrator should capture the Defender and System events first and back up relevant security policies before changing definitions or the platform.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Run Microsoft Safety Scanner
Microsoft documents Microsoft Safety Scanner as a separate, on-demand malware-checking step for service-startup failures. Run it with administrator rights, allow it to complete, and retain its results. It is a diagnostic and cleanup tool, not a replacement for continuously running Defender protection.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Remove all installed Defender definitions
If the definition database is damaged, Microsoft documents this elevated command:
MpCmdRun.exe -RemoveDefinitions -AllAfterward, update security intelligence before attempting another scan. Removing definitions temporarily leaves Defender without its normal current detection data, so do not treat this as a casual first step or leave the machine unattended and unupdated.
Reset the Defender platform
For a platform problem, Microsoft documents:
MpCmdRun.exe -ResetPlatformRun the command from an elevated console in the Defender platform directory used by your Windows installation. If the command reports an error, preserve the complete output rather than guessing at a different path or deleting folders manually.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUpdate security intelligence from Microsoft’s update service
Microsoft’s documented command for a security-intelligence update is:
Best Value
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
MpCmdRun.exe -SignatureUpdate -MMPCRestart if Windows requests it, then confirm in Windows Security > Virus & threat protection > Virus & threat protection updates that the intelligence version and update time changed.
Re-enable Defender only after the cause is removed
If a policy or another antivirus disabled Defender, first remove the conflict or follow your organization’s approved policy. Re-enabling the service while a managed antivirus is still installed can simply cause Windows to turn it off again. Microsoft’s service-startup procedure treats re-enabling Defender as a later step, after definitions and platform repair, not as a substitute for finding the cause.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Interpret common Defender error codes
| Code | Microsoft label or condition | Documented direction |
|---|---|---|
0x80508031 |
ERR_MP_PLATFORM_OUTDATED |
Use a supported Defender platform. Microsoft lists Defender Antivirus as supported on Windows 10 and Windows 11, subject to the installed edition and servicing state. |
0x8050800C |
Bad input data | Update the Defender definitions/security intelligence and retry. |
0x80508030 |
Scan condition requiring the offline path | Run Microsoft Defender Offline from Windows Security. |
Keep the code with the Event Viewer entry and the Windows version. The same visible symptom can have different causes, and a code without its timestamp or surrounding events is often insufficient to identify the failing component.
8. Do not use exclusions as a crash fix
An exclusion tells Defender not to check the selected file, folder, process, or extension in the way it normally would. Microsoft warns that exclusions stop real-time checking for the excluded item and can leave the device and its data vulnerable.
Adding an exclusion because a scan closes is therefore a protection change, not a repair. It can hide the symptom while allowing malware or a compromised process to remain unchecked. Only use an exclusion when you understand exactly what is being excluded, why it is trusted, who approved it, and how it will be removed. Record the path and review it afterward.
Compare the recovery options before you act
| Action | Evidence captured | Scope | Protection impact | Admin rights | Reboot | Reversible? |
|---|---|---|---|---|---|---|
| Windows and Defender updates | Update history and error text | Windows and security intelligence | None intended | Usually no separate elevation | Sometimes | Updates are not generally rolled back as a troubleshooting step |
| Event Viewer capture | Event IDs, timestamps, details | Diagnostic only | None | No | No | Yes; it changes nothing |
| Service-state check | Running/stopped state | Defender components | None if you only inspect | No for inspection | No | Yes |
| Remove conflicting antivirus | Installed-app and service evidence | Real-time protection ownership | May remove the other product’s protection | Often required | Usually | Only by reinstalling the other product |
| Quick or Full scan | Scan result and event ID | Running Windows | None intended | No | No | Yes |
| Offline scan | Offline-scan result and restart events | Windows Recovery Environment | None intended; Windows is unavailable during the restart | No separate console elevation | Yes | Yes |
| Definition removal or platform reset | Command output and new event entries | Definitions or Defender platform | Temporary reduction while definitions are absent or updating | Yes | May be required | Usually, after a successful update or platform repair |
| Exclusion | Exclusion list and reason | Specific path, process, or file type | Reduced checking for that item | Often required | No | Yes, but protection was reduced while it existed |
When the problem is not solved
Stop changing settings and escalate with a compact record. Include the Windows edition and build, whether another antivirus was installed, the exact time of the failure, Event Viewer entries from the Defender Operational and System logs, the scan type, the error code, service states, update results, and the output from any elevated MpCmdRun.exe command. This prevents repeated resets that erase useful evidence.
If Microsoft Defender Offline completes but normal scans still generate event 1002, compare the System log for restarts and check whether a service stops immediately before the scan event. If all expected services run, no competing antivirus is installed, and updates are current, the remaining evidence points toward a Windows component or platform issue rather than a simple Windows Security interface crash.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
