What you’re seeing
- Windows Security shows a red or yellow warning that virus and threat protection is off.
- The real-time protection switch is greyed out or flips back to off a few seconds after being turned on.
- A message says 'This setting is managed by your administrator' or 'Your virus and threat protection is managed by your organization' on a PC with no IT department.
- Defender reports another antivirus product is active, but that product was removed or its subscription expired.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- A third-party antivirus is still registered with Windows Security Center, which puts Defender into a passive or disabled state.
- Leftover remnants of an uninstalled security product keep telling Windows that another antivirus is in charge.
- A local or domain Group Policy setting, or a registry-based policy from a tuning tool, disables Defender.
- Malware deliberately switched protection off and added policies to keep it off.
- A device management service such as Intune applies an antivirus policy that conflicts with how the PC is actually protected.
Why it matters
A computer with no working antivirus is an open door for ransomware, credential theft and email-borne malware, and one infected PC can spread to file shares and other machines. Many cyber insurance policies and compliance frameworks require endpoint protection on every device, so an unprotected PC can jeopardize a claim or an audit. If malware caused the shutdown, the machine may already be compromised, which raises questions about what data has been exposed.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Could this mean the PC already has a virus?
It can. Some malware turns off Defender as its first step, so part of the work is determining whether the change was caused by leftover software, a policy, or something malicious before protection is restored.
We pay for a different antivirus. Do we still need Defender?
Not if the other product is installed, licensed and running correctly. The problem is when Windows thinks another product is protecting the PC but nothing actually is, which an engineer can confirm.