Enable and update Microsoft Defender Antivirus on Windows Server - Microsoft Defender for Endpoint (2024)

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2

If you wish to use Microsoft Defender Antivirus on your Windows Server, and it had been previously disabled or uninstalled, you may need to take further steps to re-enable it and ensure it's fully updated.

To enable and update Microsoft Defender Antivirus on Windows Server, perform the following steps:

1. Install the latest Servicing Stack Update (SSU).

2. Install the latest cumulative update (LCU).

3. Reinstall Microsoft Defender Antivirus or re-enable it. For more information on how to reinstall or re-enable Microsoft Defender Antivirus on Windows Server, see Re-enable Microsoft Defender Antivirus on Windows Server if it was disabled and Re-enable Microsoft Defender Antivirus on Windows Server if it was uninstalled.

   See Also

   Windows 11's Windows Security App can't open.How to manage Microsoft Defender Antivirus with PowerShell on Windows 10Manage Windows Firewall with the command lineHow to control Microsoft Defender Antivirus from PowerShell on Windows 11

4. Reboot the system.

5. Install the latest version of the platform update.

   Note

   Re-enabling Microsoft Defender Antivirus doesn't automatically install the platform update. You can download and install the latest platform version using Windows update. Alternatively, you can download the update package from the Microsoft Update Catalog or from the Antimalware and cyber security portal.

   If you're preparing to install the modern, unified solution on Windows Server 2016, you can leverage the Installer help script to automate the platform update and the subsequent installation and onboarding. This script can also assist in re-enabling Microsoft Defender Antivirus.

Re-enable Microsoft Defender Antivirus on Windows Server if it was disabled

First, ensure that Microsoft Defender Antivirus is not disabled either through Group Policy or registry. For more information, see Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution.

If Microsoft Defender Antivirus features and installation files were previously removed from Windows Server 2016, follow the guidance in Configure a Windows Repair Source to restore the feature installation files.

On Windows Server 2016, in some cases, you may need to use the Malware Protection Command-Line Utility to re-enable Microsoft Defender Antivirus.

As a local administrator on the server, perform the following steps:

1. Open Command Prompt.
2. Run the following command:%ProgramFiles%\Windows Defender\MpCmdRun.exe -wdenable.
3. Restart the device.

Re-enable Microsoft Defender Antivirus on Windows Server if it was uninstalled

In case the Defender feature was uninstalled/removed, you can add it back.

As a local administrator on the server, perform the following steps:

1. Open Windows PowerShell.

2. Run the following commands:

   # For Windows Server 2016Dism /Online /Enable-Feature /FeatureName:Windows-Defender-FeaturesDism /Online /Enable-Feature /FeatureName:Windows-DefenderDism /Online /Enable-Feature /FeatureName:Windows-Defender-Gui# For Windows Server 1803 and later, including Windows Server 2019 and 2022Dism /Online /Enable-Feature /FeatureName:Windows-Defender

   When the DISM command is being used within a task sequence running PowerShell, the following path to cmd.exe is required.

   C:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender-FeaturesC:\Windows\System32\cmd.exe /c Dism /Online /Enable-Feature /FeatureName:Windows-Defender

   Note

   You can also use Server Manager or PowerShell cmdlets to install the Microsoft Defender Antivirus feature.

3. Reboot the system.

Related articles

Performance analyzer for Microsoft Defender Antivirus