Only Microsoft Defender is left protecting this PC after your suite lapsed

Fix it now

Event 5000 records that Defender’s real-time protection was enabled. On a machine that ran a paid suite for years, that is Windows doing what Microsoft documents: bringing Defender back once the other product expires, is uninstalled, or stops providing real-time protection. Nothing is broken. The question is what else stopped with it.

Get-MpComputerStatus | Format-List RealTimeProtectionEnabled,AMRunningMode,AntivirusSignatureLastUpdated
Start-MpScan -ScanType FullScan

1. Open Windows Security, go to Virus & threat protection, and under Who’s protecting me? choose Manage providers. Confirm the Security providers page now shows Microsoft Defender Antivirus turned on.
2. Open the old suite if it is still installed and read its subscription status, so you know whether it lapsed or simply failed.
3. If it has lapsed and you are not renewing, uninstall it with the vendor’s removal tool so it cannot reclaim the registration on a future update.
4. Let the full scan finish before you consider the machine settled.

Do not reinstall the old product just to make the log entry stop. Event 5000 is a record of protection starting, not of anything failing.

If Defender is registered, updating and scanning cleanly, the technical work is finished. The next section covers what a suite was actually giving you, so you can decide whether any of it needs replacing.

Why it happens

Windows hands antivirus duty to whichever product is registered and reporting itself as active. Microsoft documents that Defender steps aside when a non-Microsoft product is installed as the primary antivirus, into disabled mode on an ordinary Windows client, and that it can be re-enabled automatically if that product expires, is uninstalled, or otherwise stops providing real-time protection. Event 5000 is the second half of that sentence happening on your machine.

Two neighbours often appear at the same time. 5004 records that the real-time protection configuration changed, which is what a handover looks like from the configuration side. 5008 records that the antimalware engine encountered an error and failed, and it can turn up while one product’s components are being unloaded and another’s are starting. A single 5008 during a changeover is not the same as 5008 repeating on a settled machine.

So the scanning is covered. What is not covered is everything the suite bundled around the scanner, and that is where people are caught out, because none of it produces a log entry at all. Suites sell on breadth rather than on detection alone: cover for phones, tablets and Macs on one subscription, a VPN, a password manager, backup storage, identity monitoring. Those stop on the day the subscription does, silently.

Event 5100 is a separate matter and worth telling apart from anything to do with the old product. Microsoft publishes it as a warning that the antimalware platform expires soon, and 5101 as the platform being expired. Both are about Defender’s own components falling behind, usually on a machine that has been off or offline for a long time, and both are fixed with Windows Update rather than with a purchase.

Full reference

What Windows includes and what a suite adds

Read that table as a list of decisions rather than a scorecard. The first four rows are the reason most people do not need to buy anything after a suite lapses. The last five are the reason some people do, and none of them is a scanning question.

Confirming the handover finished properly

A single 5008 at the moment of the changeover is unremarkable. 5008 repeating on a machine that has been settled for days is an engine failure in its own right and should be treated as one.

Running the scan

Start-MpScan -ScanType FullScan runs a full scan from PowerShell, and the documented values for that parameter are FullScan, QuickScan and CustomScan. The same job from a Command Prompt is MpCmdRun.exe -Scan -ScanType 2, where 2 is the full scan. Either is worth running once after a changeover, because the period between one product stopping and the other starting is the window nothing was watching.

If Defender itself is behind

Events 5100 and 5101 report the antimalware platform expiring soon and having expired. On a machine that has been off for months, that is why Defender may not simply pick up the slack. The fix is Windows Update run to completion, followed by Update-MpSignature, and then a full scan. No licence is involved at any point, and no third-party product changes it.

Deciding whether to replace anything

• List what you actually used. Most people used the scanner and nothing else, and Windows covers that.
• Count devices, not people. The common reason to buy is a household with phones, tablets and Macs that Windows does not reach at all.
• Check what you are already paying for. Cloud storage and a password manager are frequently already covered by another subscription.
• Do not buy on the strength of the log entry. Event 5000 says protection started, which is the opposite of an emergency.

Every code this article covers

Confirm the fix worked

1. The Security providers page lists exactly one antivirus and describes it as turned on.
2. Get-MpComputerStatus reports RealTimeProtectionEnabled True and a signature timestamp from today.
3. A full scan completes and writes a result to Protection history.
4. No repeating 5008 entries appear in the Defender operational log after the changeover.
5. The arrangement survives a restart rather than switching back after logon.

Questions people ask about this