How to Fix Windows Defender Threat Service Has Stopped Error
Question details
The user is attempting to restore their system's security protection after encountering an error where the Windows Defender threat service stops running unexpectedly.

- Product
- Microsoft Windows Defender
- Device & OS
- Windows
- Scenario
- Trying to open Windows Security to perform a scan or ensure real-time protection is active.
- Observed behavior
- Windows Security displays an error message stating that the threat service has stopped. The service refuses to start automatically, leaving the system potentially unprotected.
Ensure you are logged into an account with Administrator privileges, as elevated permissions are required to modify system accounts, uninstall software, and execute PowerShell commands. Close all background applications and Office programs before proceeding.
Disconnect Conflicting Work or School Accounts
Administrative policies from connected work or school accounts can override local security settings and force Windows Defender services to stop.
Organizations often apply group policies that manage how security features behave on connected devices. Disconnecting these accounts removes the restriction and allows Defender to operate normally.
Click on the Start menu and select the 'Settings' gear icon, or press the Windows key + I on your keyboard.
Click on 'Accounts' from the main settings menu, then select 'Access work or school' from the left-hand sidebar.
Click on any connected work or school accounts that are not strictly necessary for your personal use, and select the 'Disconnect' button.
Restart Windows to apply the changes and open Windows Security to verify that the threat service is running again.

Uninstall Conflicting Third-Party Antivirus Software
Third-party antivirus programs often disable Windows Defender automatically to prevent software conflicts and system instability.
Reset Windows Defender via PowerShell
If Defender components are damaged, running a reset command through an elevated PowerShell session can restore its default functionality.
Need a Lightweight Office Suite Unaffected by Complex Security Policies?
If enterprise security policies, connected accounts, and continuous Windows Defender errors are disrupting your Microsoft Office workflow, consider switching to WPS Office. It provides a standalone, highly compatible workspace without being bogged down by complex Windows account integrations.
- 1. Visit the WPS Office Website: Go to the official WPS website to access the latest version of the office suite.
- 2. Download the Installer: Click the 'Free Download' button to save the lightweight installation file to your computer.
- 3. Install and Launch: Run the installer, follow the simple on-screen setup instructions, and start working immediately without complex account sign-ins.

Frequently Asked Questions
Why does Windows Defender say the threat service has stopped?
This error usually occurs when another third-party antivirus program is actively running and takes over security duties, or when a connected work or school account applies administrative policies that intentionally disable Windows Defender services.
Will resetting Windows Defender using PowerShell delete my personal files?
No, resetting Windows Defender via PowerShell using the ResetPlatform command only restores the security application's configuration files to their default states. It does not affect your documents, photos, or other personal data.
How do I start Windows Defender in Safe Mode for troubleshooting?
To enter Safe Mode, hold the Shift key while selecting 'Restart' from the Windows Start menu. Then, navigate to Troubleshoot > Advanced options > Startup Settings > Restart, and press F4 or F5 to boot into Safe Mode, where you can safely run diagnostics.
What should I do if the PowerShell reset command fails?
If the built-in reset command fails, ensure you are running PowerShell as an Administrator. Avoid manually modifying protected system files or deleting registry keys. If the issue persists, contact official Microsoft Support for advanced diagnostics.




