Missing Windows Defender? Install and manage Microsoft Defender via Windows Security on Windows Server

Microsoft Defender Antivirus protects your device from viruses, malware, and potentially unwanted applications. By default, Microsoft Defender Antivirus is installed and functional on Windows Server. This article will discuss how to fix “Missing Windows Defender: Install and manage Microsoft Defender via Windows Security on Windows Server”. You can use PowerShell, Group Policy, or other methods to manage Microsoft Defender Antivirus. Please see how to Remove Microsoft Defender Update on Windows 10 & Server, and Windows Defender Antivirus Management with Intune.

Note: Most of the new Windows Server operating systems come with Windows Defender already installed and working. Most times, you do not have to do this. But if you wish to use Microsoft Defender Antivirus on your Windows Server that had been previously uninstalled. You may need to take further steps to re-enable it and ensure it’s fully updated as discussed below.

See how to Configure Data Deduplication on Windows Server 2022, how to Test Your Webcam And Microphone Before Meeting, and how to convert Windows Server Essentials or Evaluation to Retail Edition.

Check Windows Defender Antivirus

There are numerous ways to determine this. But in this article, we will be using PowerShell. Windows Defender can be disabled or removed due to numerous. In some cases, to improve performance, update errors or conflict with other applications.

To do this, get on your Windows Server and Open “Windows Powershell“ as an administrator.

Run the following command to check the Windows Defender Antivirus state on the server. As you can see, we have the Microsft Defender installed on this server.

Get-WindowsFeature | Where-Object {$_. name -like "*defender*"} | ft Name,DisplayName,Installstate

On another Server, you can see it is available.

This means Windows Defender (now Microsft Defender) is not installed.

Enable Microsoft Defender using the Add Roles and Features Wizard

Launch the Add Roles and Features Wizard

If you have multiple servers in the pool, select the server you wish to install Microsft Defender to.

Skip the Server Roles page by clicking on Next. On the Features window, select Windows Defender Antivirus.

As you can see, this feature has not been selected

The Windows Defender antivirus has been selected. 

Click next to complete the installation

On the confirmation page, click “Install.” Select the option “Restart the destination server automatically if required” is enabled.

If a role or feature requires a restart during its installation or uninstallation, the reboot will occur automatically with this option enabled.

Note: In case you don’t find the Windows Defender features in the list of server features, it means that the Windows Defender core feature has been disabled on the server.

Learn how to Set Microsoft Defender Antivirus to Passive Mode or Active Mode, how to Create Self-Hosted Agent for Azure DevOps Pipelines, and How to Permit a Blocked File or App in Windows Security Manually

Turn on the Windows (Microsoft) Defender using PowerShell

PowerShell can turn on Windows Defender on Windows Server operating systems. Using the PowerShell command is probably much easier and quicker than the previous method.

On your Windows Server, open Windows PowerShell as an administrator.

Run the following command to enable Microsft Defender.

Dism /Online /Enable-Feature /FeatureName:Windows-Defender

Select Yes (Y) to reboot the system.

Note: For Windows Sever 2016, please run the commands below.

Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features
Dism /Online /Enable-Feature /FeatureName:Windows-Defender
Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Gui

Update Microsoft Defender Antivirus

Note: Re-enabling Microsoft Defender Antivirus doesn’t automatically install the platform update. You can download and install the latest platform version using Windows update. Alternatively, you can download the update package from the Microsoft Update Catalog.

Also, see how to update Microsoft Defender Antivirus into the install image of Windows (install.wim), and how to View Microsoft Defender Antivirus Update Details on Windows 10 Image.

Tamper Protection

Now that you have decided to install Microsft Defender Antivirus, please ensure Tamper protection is enabled. Tamper protection helps keep always-on protection and other security settings from being changed.

As a result, when tamper protection is enabled, any changes made to tamper-protected settings are ignored. If you must make changes to a device and those changes are blocked by tamper protection.

Note: Microsoft recommends using troubleshooting mode to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state.

Here are some related article on Tamper Resistant “Tamper Protection for Microsoft Defender on Windows 10 [Part 1], and Protect Microsoft Defender Settings with Tamper Protection“.

Stay protected with Windows Security

Windows Security also includes Windows Security. This provides you with the latest antivirus protection. Your device will be actively protected from the moment you start Windows Server. Please see How to stay protected on Windows 10 and 11 device with Windows Security.

Windows Security, also known as Microsoft Defender Antivirus, is inherent to Windows. If another antivirus application is active, Microsoft Defender Antivirus deactivates. Uninstalling the third-party app automatically reactivates Microsoft Defender Antivirus.

Windows Security continually scans for malware (malicious software), viruses, and security threats. In addition to this real-time protection, Updates are downloaded automatically to keep your device safe and protect it from threats.

Remove Microsft Defender antivirus

If you wish to remove Microsft Defender Antivirus based on the above reasons mentioned d or many others. You can use the following PowerShell cmdlet. 

Uninstall-WindowsFeature -Name Windows-Defender

Or via DISM

Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

Alternatively, you can use the Server Manager to remove Windows Defender Antivirus from your PC. Open Server Manager, and from Manage menu, click Remove Roles and Features.

As you can see, Windows Defender Antivirus is being removed.

Close the removal wizard.

Manage Antivirus via GPO

You can use Group Policy to manage some Microsoft Defender Antivirus settings. Note that if tamper protection is enabled in your organization, any changes made to tamper-protected settings are ignored. You can’t turn off tamper protection by using Group Policy.

Microsoft recommends using Microsoft Intune to manage Microsoft Defender Antivirus settings for your organization. With Intune, you can control where tamper protection is enabled (or disabled) through policies. You can also protect Microsoft Defender Antivirus exclusions.

Below are the available policies available to manage Microsft Defender via GPO.

Launch group policy via gpedit, In the left pane of Local Group Policy Editor, expand the tree to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus.

I hope you found this article useful on fixing “Missing Windows Defender: Install and manage Microsoft Defender via Windows Security on Windows Server”. Please feel free to leave a comment below.