WinDefend is the Windows service behind Microsoft Defender Antivirus. It scans files and processes, receives security-intelligence updates, and can block or remediate threats when Defender is active. The Windows Security app is a separate interface, while SecurityHealthService and wscsvc report protection status. A stopped-looking Defender service is often intentional when another antivirus is active, but it can also indicate a policy, update, driver, or service problem.
What the Windows Defender service actually is
Microsoft maps the service name WinDefend to Microsoft Defender Antivirus and its MsMpEng.exe process. Defender is built into Windows 10, Windows 11, and supported Windows Server editions. When Defender is the active antivirus, it provides real-time, behavior-based, heuristic, and cloud-delivered protection; monitors files and processes; downloads security-intelligence updates; and remediates detections according to its configuration.
As an Amazon Associate I earn from qualifying purchases.
“Windows Security” is not another name for WinDefend. Windows Security is the user-facing app that gathers protection information and exposes controls such as scans, updates, exclusions, and provider selection. Two additional services supply much of the status information shown there:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Component | Role | What a problem means |
|---|---|---|
WinDefend |
Main Microsoft Defender Antivirus service, associated with MsMpEng.exe. |
Defender may not scan or remediate when it is the active provider. |
SecurityHealthService |
Windows Security Service that supports the health and status experience. | The display can be incomplete or stale; this does not, by itself, turn off Defender. |
wscsvc |
Windows Security Center Service, which reports antivirus and firewall providers, including third-party products. | Status notifications can be inaccurate even if Defender and Windows Firewall continue operating. |
WdBoot, WdFilter, WdNisSvc, and WdNisDrv |
Related Defender boot, file-filter, network-inspection, and driver components. | A missing or stopped related component can prevent normal startup or reduce coverage. |
Microsoft explicitly says that disabling Windows Security Center does not disable Microsoft Defender Antivirus or Windows Firewall. It does, however, remove or stale the status layer you rely on to see whether protection is working, so leaving those status services disabled is a poor troubleshooting outcome.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Defender operating modes and why WinDefend may look stopped
Defender has three practical states:
- Active (Normal): Defender is the primary antivirus and can scan, block, and remediate threats.
- Passive: Defender can scan and report, but another product or management configuration is the primary remediator.
- Disabled or uninstalled: Defender performs no scanning or remediation.
If a current third-party antivirus is installed, Windows can intentionally disable Defender or place it in passive mode. This is not automatically a fault. Uninstalling the other antivirus can allow Defender to become active again, although tamper protection, Group Policy, mobile-device management (MDM), or enterprise security policy can prevent a local change.
For a gaming PC, check the active provider before changing services. Running two products as primary real-time antivirus engines can create conflicts, while a passive Defender state may be expected under the security product you chose. Do not infer the operating mode solely from a notification or a greyed-out switch.
Check which antivirus is active before repairing anything
Use Windows Security
- Open the Start menu, search for Windows Security, and launch it.
- Select Virus & threat protection.
- Choose Manage providers. The Antivirus section identifies the provider currently handling protection and whether Microsoft Defender is active, passive, or unavailable.
If a third-party antivirus is listed as current and up to date, a non-running WinDefend service may be deliberate. If no provider is active, continue with the status and service checks below rather than immediately editing service settings.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRead the Defender state in PowerShell
Open PowerShell normally for a status check and run:
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Get-MpComputerStatus
Look for AMRunningMode. Microsoft identifies the value Normal as active mode. A passive value means Defender is present but not the primary remediator; a disabled state means it is not providing Defender scanning. The command is a read-only diagnostic and is safer than forcing a service start without knowing which provider Windows selected.
Inspect WinDefend and related services
When Defender should be active but fails to start, open an elevated PowerShell window (right-click PowerShell and choose Run as administrator) and run this Microsoft troubleshooting command:
Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status
Review the StartType and Status columns together. WinDefend is the main antivirus service; the Wd components are related drivers and inspection services; the last two entries are status services. A stopped wscsvc explains missing or stale provider information, not necessarily a stopped antivirus engine. A stopped related Defender driver deserves attention when WinDefend will not start or scans fail.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Do not change startup types or disable services at random. Security policy can intentionally control them, and tamper protection may reject a local change. If the command reports that a service is missing, or an enterprise-managed computer immediately reverses a change, contact the administrator rather than deleting registry entries or using unverified “service repair” scripts.
Restore normal protection in the safest order
1. Remove an intentional provider conflict
In Virus & threat protection > Manage providers, identify the active antivirus. If you no longer want the third-party product, uninstall it through Settings > Apps > Installed apps (the exact label can vary by Windows version), restart Windows, and check the provider page again. Uninstalling can allow Defender to turn back on, but some products leave management components behind; use that product’s normal removal process if Windows still reports it as active.
2. Check policy and tamper protection
On a work, school, or managed gaming-PC account, Group Policy or MDM may set Defender to passive or disabled mode. Tamper protection can also block attempts to change security settings. A local administrator cannot always override those controls. Confirm the device’s management status and ask the organization’s administrator to make the change. Avoid registry edits intended to bypass policy; they can leave the protection state and Windows Security display out of sync.
3. Bring the engine and security intelligence up to date
Defender depends on current engine and security-intelligence updates. In Windows Security, open Virus & threat protection, select Virus & threat protection updates, and choose Check for updates. Windows Update, Windows Server Update Services (WSUS), or another approved enterprise update service can supply these updates. If the update control fails, check whether Windows Update is paused, whether the PC can reach the organization’s update service, and whether policy intentionally controls updates. A stale update channel can make startup and detection problems persist even when the service itself is present.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
4. Restart Windows and recheck the state
After removing a conflicting antivirus or completing updates, restart the computer. Reopen Windows Security, check Manage providers, and run Get-MpComputerStatus again. A restart reloads Defender’s boot and filter components and gives policy and provider registration a clean opportunity to settle.
5. Run a scan appropriate to the symptom
From Virus & threat protection, select Quick scan for an initial check. Use Scan options for a Full scan or any other scan types offered by your Windows edition. A scan result does not prove that a service-start problem is fixed, but it confirms whether Defender can perform its core inspection when active.
6. Review exclusions instead of adding broad ones
Exclusions can cover a file, folder, process, or extension, but an excluded item is skipped by real-time scanning and leaves the device more exposed. Review Virus & threat protection > Manage settings > Exclusions and remove entries that are no longer required. Add an exclusion only for a documented compatibility need, keep it as narrow as possible, and do not exclude an entire game library or system drive merely to suppress a warning.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhy the service can still appear wrong after these checks
Windows Security is showing old information
If SecurityHealthService or wscsvc is disabled, Windows Security may report an old provider state. Re-enable status reporting only through your organization’s approved configuration; do not treat a stale dashboard as proof that WinDefend is off. Verify the engine directly with Get-MpComputerStatus and the service table.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
A filter driver or network component is unavailable
Defender’s related boot, file-filter, and network-inspection components participate in normal operation. If WdBoot, WdFilter, WdNisSvc, or WdNisDrv is stopped or missing while Defender is supposed to be active, record the exact status and consult your administrator or Microsoft support process. Repeatedly forcing starts without resolving the underlying driver or policy condition can create a misleading “running” status with incomplete protection.
Updates are controlled outside the PC
On Windows Server or an enterprise-managed Windows installation, WSUS, Windows Update policy, or another approved service may control both engine and security-intelligence updates. A local “Check for updates” action may therefore be unavailable or may report that the device is current according to policy. Escalate with the update-management administrator instead of replacing the configured source.
What not to do
- Do not disable
wscsvcorSecurityHealthServiceto hide warnings; that removes useful status information without disabling Defender. - Do not run two primary real-time antivirus products and assume a stopped WinDefend service is automatically broken.
- Do not turn off tamper protection, Group Policy, or MDM controls on a managed device to force a local setting.
- Do not add wide exclusions for game folders, downloads, or whole drives when a narrow, documented exception would suffice.
- Do not treat a successful service start as proof that definitions and the engine are current; check updates and run a scan.
When to escalate
Seek administrator or Microsoft support help when WinDefend and a related driver are missing, policy immediately restores a disabled state, updates cannot reach the approved source, or Windows Security and Get-MpComputerStatus disagree after a restart. Provide the service-table output, the AMRunningMode value, the active provider shown under Manage providers, and whether the computer is managed by an organization. Those details distinguish an intentional passive configuration from a broken Defender installation without requiring risky changes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
As an optional shortcut for broader Windows stability or cleanup problems that accompany a Defender issue, Outbyte PC Repair can address certain common system issues, adjust resource-heavy settings, clean temporary and cache files, check selected vulnerabilities, and provide tools such as a real-time boost, file shredder, and crash log. It complements antivirus software rather than replacing it; results vary and no tool repairs every crash. It runs on Windows 11, 10, 8, and 7 with a free trial by category for at least two days, followed by a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
