How to Re-Register Defender After an Antivirus Uninstall Left a Residue

Quick fix: Third-party antivirus uninstall sometimes leaves driver and registry remnants that prevent Defender from taking over. Run the vendor’s official cleanup tool (Norton Removal Tool, McAfee MCPR, Avast Removal Utility), then in elevated PowerShell: Set-MpPreference -DisableRealtimeMonitoring $false and reboot.

You uninstalled Norton, McAfee, Kaspersky, or another third-party antivirus. Microsoft Defender should have automatically resumed protection. Instead, Windows Security shows Defender as off, or unable to enable. The uninstall left residue that’s blocking Defender.

What residue blocks Defender

Third-party AVs install kernel-level drivers that register themselves with Windows’ security center. The uninstaller is supposed to remove these, but partial uninstalls leave the driver registered as the “active” AV. Defender then assumes another AV is handling protection and stays off.

Method 1: Run the vendor’s official removal tool

1. Visit the AV vendor’s site. Find their dedicated removal/cleanup tool:
   
     Norton: Norton Remove and Reinstall Tool
   
     McAfee: MCPR
   
     Kaspersky: kavremover
   
     Avast/AVG: avastclear / AVG Remover
   
     Bitdefender: Bitdefender Uninstall Tool
2. Run as Administrator. Tool wipes all residue.
3. Reboot.

Method 2: Force Defender re-registration via PowerShell

1. Open elevated PowerShell:
   
   Set-MpPreference -DisableRealtimeMonitoring $false

Set-MpPreference -DisableBehaviorMonitoring $false

Set-MpPreference -DisableIOAVProtection $false
2. Restart the Windows Defender Antivirus Service:
   
   Restart-Service WinDefend
3. Open Windows Security. Defender should now be active.

Method 3: Re-register Defender via DISM

1. Open elevated Command Prompt.
2. Run dism /online /enable-feature /featurename:Windows-Defender.
3. If Defender was disabled at the OS feature level, this re-enables it.
4. Reboot.

Verification

• Windows Security → Virus & threat protection. Defender shows as active and monitoring.
• Run Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled — both True.
• Run a Quick Scan via Windows Security to confirm.

If none of these work

If Defender refuses to enable after all methods, an in-place repair upgrade reinstalls Defender at the system level. For chronic AV cleanup issues, use Revo Uninstaller’s deep scan to find leftover registry entries from the previous AV.

Bottom line: Third-party AV residue blocks Defender. Vendor cleanup tools + PowerShell re-register usually restore Defender. In-place repair as last resort.