Defender event 5001: real-time protection off while another antivirus holds the registration

Fix it now

Event 5001 records that Defender’s real-time protection was disabled. On a machine with a third-party antivirus that is by design. It becomes a problem when that product has expired, because Microsoft documents Defender re-enabling itself in that case, so a machine still showing 5001 has nothing watching it.

Get-MpComputerStatus | Format-List RealTimeProtectionEnabled,AntivirusEnabled,AntispywareEnabled,AMRunningMode,AntivirusSignatureLastUpdated

1. Open Windows Security, go to Virus & threat protection, and under Who’s protecting me? choose Manage providers. The Security providers page names the product Windows currently treats as your antivirus.
2. Open that product and read its subscription status and expiry date. That single fact decides everything below.
3. If it has expired, decide now: renew it, or uninstall it with the vendor’s own removal tool so Defender can take the registration back.
4. Restart, then check the Security providers page again and confirm exactly one antivirus is listed and it is current.

Do not try to run both. While another product holds the registration, Defender will keep standing down, and two products competing for the same file operations is the state you are trying to leave.

If exactly one current product is registered and real-time protection is on, you are done. If Defender is still off with nothing valid in front of it, the next section explains why that is not the documented behaviour.

Why it happens

Windows keeps a register of installed security products. When a non-Microsoft antivirus is installed as the primary product, Microsoft documents that Defender goes into disabled mode on Windows 10 and 11, so two engines are not competing for every file operation. Event 5001 is the record of that: real-time protection is disabled. Events 5010 and 5012 sit beside it and name what went with it, scanning for malware and other potentially unwanted software, and scanning for viruses.

Passive mode is a different thing and it is worth not confusing the two, because Microsoft describes both. Its compatibility guidance says Defender enters disabled mode on Windows client when a non-Microsoft product is installed as the primary antivirus; its passive-mode guidance describes Defender entering passive mode automatically, and lists onboarding to Microsoft Defender for Endpoint as a prerequisite for passive mode. On an unmanaged PC running a consumer suite, disabled is the one you have, so there is no second engine quietly scanning underneath. Get-MpComputerStatus | select AMRunningMode settles it: Normal, Passive or EDR Block Mode.

The part most articles get backwards is what expiry does. Microsoft’s published behaviour is that Defender can be re-enabled automatically if the non-Microsoft product expires, is uninstalled, or otherwise stops providing real-time protection. Expiry is supposed to be the trigger that brings Defender back. So a machine that still shows 5001 weeks after a suite lapsed is not following the documented path, and the question to ask is what is still telling Windows the machine is covered.

There are only a few answers to that question. The expired product is still registered and still reporting itself as protecting. A product that was removed left its registration behind. Or Defender is being held off by policy that was applied while the other product was in charge. Event 5101 is a fourth and separate case: it records that the antimalware platform is expired, which is Defender’s own state rather than anything to do with the other product.

Full reference

What each entry in this family records

Read them as a sequence rather than one at a time. A 5001 with 5010 and 5012 immediately after it is a handover: something took the registration and Defender stepped aside cleanly. A 5001 on its own, with no third-party product installed, is a configuration or policy change and belongs in a different investigation.

Working out where you actually stand

Checking it from the command line

The interface reports the last state it was told about. Get-MpComputerStatus reports what the service believes right now, which is the number to trust when the two disagree. RealTimeProtectionEnabled, AntivirusEnabled and AntispywareEnabled map directly onto events 5001, 5012 and 5010, and AMRunningMode tells you which mode Defender considers itself to be in.

Do not respond to this by turning the other product’s real-time protection off and leaving it installed. It keeps the registration either way, so Defender stays down, and you end up with two products that are both switched off. Remove one properly or licence one properly.

If you decide to keep the paid product

Renewing is the straightforward route when the suite is doing something Windows does not: covering phones, tablets and Macs on the same subscription, or providing a VPN, a password manager or backup. Those are the parts that actually lapse. Apply the licence to the installation that is already there rather than reinstalling, because a reinstall usually loses your exclusions and settings for nothing.

If you decide not to

Remove the product with the vendor’s own removal tool rather than through Settings alone, restart, and confirm on the Security providers page that Microsoft Defender Antivirus is turned on. Then run a full scan, because the window between the subscription ending and Defender coming back is a period nothing was watching. That route costs nothing and is a legitimate answer, provided you finish it.

Every code this article covers

Confirm the fix worked

1. Windows Security, Virus & threat protection, Manage providers lists exactly one antivirus and it is current.
2. Get-MpComputerStatus reports RealTimeProtectionEnabled as True, or the third-party product shows a future expiry date.
3. No new 5001, 5010 or 5012 entries appear in the Defender operational log after a restart.
4. A full scan completes and writes a result to Protection history.
5. The state survives a restart rather than reverting at the next logon.

Questions people ask about this