The antivirus on this computer shows as off, and nobody turned it off.

See what it is set to

1. Open Windows Security from the Start menu.
2. Select Virus & threat protection, then Manage settings.
3. Read the Real-time protection toggle. When it is off, Microsoft says, “files you open or download won’t be scanned for threats.”
4. Photograph the screen with the date and time visible before you change anything.

Ordinary reasons it reads off

Each of these has a person and a date attached. If no one can supply either, keep reading.

When you ask, ask for three facts: who changed it, on what date, and for what reason. An ordinary answer arrives quickly and names all three.

• Someone paused it on purpose. Microsoft describes this as brief, and the setting returns on its own.
• A different security program is installed. Microsoft’s documentation says non-Microsoft antivirus programs register with the Windows Security app, and the built-in antivirus can run in a passive mode alongside them. The warning then points to which program is in charge.
• The computer is managed by an IT provider whose tools set the options. Ask them before assuming anything else.

Signs that point away from the ordinary

• It turns off again after you turn it on.
• It was on the last time anyone looked, and no one can name the change.
• A remote-access program, an unfamiliar user account, or an unknown startup program appeared around the same time.
• The list of items the antivirus is told not to scan, called exclusions, holds a folder nobody can explain.

What Windows is built to resist

Microsoft writes that “attackers often try to disable security features on devices to access data, install malware, and exploit data, identities, and devices.” Windows has a feature for this called tamper protection. When it is on, Microsoft lists these as settings that cannot be changed: real-time protection, behavior monitoring, cloud protection, automatic actions on detected threats, and the exclusion list. Attempts to change antivirus settings through the registry are blocked.

If that feature is turned on and real-time protection still reads off, that is a stronger signal than the same reading without it. Microsoft names Event ID 5013 as the event to look at when tamper protection blocks a change. Some older Windows versions do not show the tamper protection status in the Windows Security app at all.

One computer or several

Check a second computer. If one machine reads off and the rest read on, the cause is something done on that machine. If several read off at once, look at what they share: a recent installer, a management setting, or one person’s sign-in.

Also note the Windows version. Microsoft states that on some older Windows 10 versions the Windows Security app does not show tamper protection status at all, so a missing status line on an old build may reflect the version rather than the setting.

Write it down, then turn it back on

1. Record the date and time you noticed, what the toggle read, and the photo.
2. Note any other security program listed in Windows Security.
3. Note who has an administrator sign-in on this computer.
4. Turn real-time protection back on, then check an hour later and again the next day whether it is still on.
5. A quick scan from the same screen (Virus & threat protection, Quick scan) is reasonable. Its result covers only what it scanned.

What we check with you

The antivirus’s own detection history and any setting changes, the user accounts and when they were created, and what starts at sign-in. A person compares that with what you expect and writes up the result with dates.

An antivirus that was switched off is a question about who had the access to switch it, and the answer to that sets what comes next.

Related

• A Remote-Access Program You Did Not Install
• A User Account on a Computer That Nobody Created
• Computer Working Hard When No One Is Using It
• How to Tell Whether Windows Updates Were Installed

Sources

• Microsoft Support: Stay protected with the Windows Security app
• Microsoft Learn: Tamper protection overview