Defender event 5001 means real-time protection was disabled, normally by another antivirus holding the registration. Here is the mechanism and the fix.