How to fix Windows Defender error code 0x800106ba on Windows 10 and Windows 11?

Error 0x800106ba means the Microsoft Defender Antivirus service is not running, so a scan, an update or a PowerShell command has nothing to talk to. Most often another antivirus switched Defender off, less often a policy or a damaged Defender engine. Check which antivirus is active first, then remove what blocks Defender.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What error code 0x800106ba means in Microsoft Defender

0x800106ba is an HRESULT that Microsoft Defender Antivirus returns when its service is not running. Microsoft's page about the MpCmdRun tool lists it under common errors with one line: "The Microsoft Defender Antivirus service is disabled. Enable the service and try again."

Every Defender tool is only a front end. Windows Security, MpCmdRun.exe, the PowerShell Defender commands and the update installer all hand their work to one service, Microsoft Defender Antivirus Service (service name WinDefend). When that service is off, each of them fails with the same number.

• Spellings. 0x800106ba, 0x800106BA, 800106ba, hr=800106BA and HRESULT 0x800106ba are the same code. People also search it with "errore" (Italian) and "Fehlercode" (German).
• A telltale sign. When the service is off, MpCmdRun often prints Service Version: 0.0.0.0 and Engine Version: 0.0.0.0 above the error, as users posting on Microsoft Q&A report.
• Not the same as 0x800706ba. That code differs by one digit and means "The RPC server is unavailable" (Win32 error 1722). It shows up with printers and remote tools, not with Defender.

Where 0x800106ba appears: scans, MpCmdRun, PowerShell and Windows Update

The words around the code depend on the tool you used. The table lists the messages people search for and what each one tells you.

Older Windows Defender showed it in a window. A reader on Microsoft Q&A quoted it in full: "Your PC couldn't be scanned. The program's service has stopped. You can start the service manually or restart your computer, which will restart the service." Below that it read Error code: 0x800106ba. Current Windows Security shows Threat service has stopped. Restart it now. without a code, as Microsoft's own screenshots show.

What causes error 0x800106ba, from most to least common

Most often another antivirus is installed, even an expired trial, and Windows has switched Defender off. Less often a policy or a "disable Defender" tweak has turned it off. Rarely the Defender engine itself is damaged, or malware stopped it.

How to fix Windows Defender error 0x800106ba

Fix 1 takes five minutes and tells you which of the next fixes you need. Fix 2 ends most cases. Fix 3 and Fix 4 are for PCs without another antivirus. Fixes 5 to 7 come last, because they help only once the service can run again.

Fix 1. Check which antivirus is active and whether the Defender service runs

5 minutesNo riskEveryone with this error. It decides which of the next fixes you need.

Microsoft writes that when you install a compatible non-Microsoft antivirus, Defender turns itself off. In that state 0x800106ba is the expected answer to any Defender command, so the first question is which program protects the PC.

1. Select Start, type Windows Security and open the app.
2. Select Virus & threat protection. If the page names another program as your antivirus, that program is active and Defender is off. Go to Fix 2.
3. If the page shows Threat service has stopped. Restart it now., select Restart now once and wait a minute.
4. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin).
5. Ask Defender for its state. AMRunningMode should read Normal, and the other three values True.

   Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

6. If that command itself fails with 0x800106ba, list the services Microsoft asks you to check.

   Get-Service WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, SecurityHealthService, wscsvc | Format-Table -Auto DisplayName, Name, StartType, Status

7. Compare the result with the table below.

Fix 2. Uninstall the other antivirus completely, including its leftovers

15 to 30 minutesLow riskWindows Security names another antivirus, or one was installed in the past, even as a trial that came with the PC.

Microsoft states that Defender can switch itself back on when the other antivirus expires, is uninstalled or stops giving real-time protection. A half-removed product can keep its registration, so Windows still thinks someone else protects the PC.

1. Uninstall from the Start menu. Select Start > All apps and find the app. Right-click it (or press and hold) and select Uninstall.
2. Or uninstall in Settings. Select Start > Settings > Apps > Installed apps. Find the app, select More (the three dots) > Uninstall, and confirm.
3. Or uninstall from Control Panel. Some programs can only be removed here. Type Control Panel in the search box on the taskbar and open it, then select Programs > Programs and Features. Right-click the program and select Uninstall or Uninstall/Change, then follow the program's own uninstaller.
4. Restart if the uninstaller asks. Some programs finish removing their files only after a restart.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Uninstall a program or app in Windows

1. Restart the PC after the uninstaller ends, even if it does not ask.
2. Open the support site of the antivirus maker and search for its removal tool. Many vendors offer one for exactly this case. Run it and restart again.
3. Open Windows Security > Virus & threat protection. After the restart Defender should be listed as active.
4. Run the command that showed 0x800106ba once more.

• An expired antivirus counts too. A reader on Microsoft Q&A had an expired product still installed, and Defender would not start until it was removed.
• Never run two real-time scanners. If you install a different antivirus later, Defender steps aside again, and this error returns for Defender commands. That is normal.

Fix 3. Remove the policies and tweaks that turn Defender off

10 minutesRead the warningNo other antivirus is installed, but Defender stays off, or you once used a tool or script that "disables Defender".

Group Policy, privacy tools and scripts switch Defender off by writing values under the policies key. Windows obeys them at every start, so the service never runs. Microsoft's repair steps back up this key and then delete it.

Before any registry change, keep a copy of the registry: Back up the registry before editing it

1. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin).
2. Back up the Defender policies, as Microsoft's repair steps do.

   New-Item -Path "C:\DefenderTemp" -ItemType Directory; reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" C:\DefenderTemp\_DefenderAVBackup.reg

3. If the export reports that the key does not exist, no policy turns Defender off. Skip to Fix 4.
4. Delete the policies.

   Remove-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Recurse -Force

5. Open an administrator Command Prompt, go to the Defender folder and switch Defender back on with the command Microsoft documents for this.

   cd /d "%ProgramFiles%\Windows Defender"
   MpCmdRun.exe -WdEnable

6. Restart the PC and open Windows Security > Virus & threat protection.

If a policy still sets Defender off after the restart, it comes back from somewhere. On Windows Pro check the Local Group Policy Editor, which shows Defender settings under Windows Components: Open the Local Group Policy Editor

• Tamper Protection. Microsoft's steps end by checking that Tamper Protection is on, in Virus & threat protection settings > Manage settings. It stops apps from changing Defender settings behind your back.
• Work or school PC. Copy the error and the output of Fix 1 and send them to your IT team.

Fix 4. Reset the Defender engine, definitions and platform with MpCmdRun

10 minutesLow riskNo other antivirus and no policy, but MpCmdRun shows version 0.0.0.0, or updates fail with hr=800106BA.

A failed update can leave the engine or the platform files half replaced, and then the service cannot start. Microsoft's repair removes the security intelligence and engine, puts the platform back to the copy that ships with Windows, and downloads fresh files.

1. Select Start, type cmd, right-click Command Prompt and select Run as administrator.
2. Go to the Defender folder. Microsoft notes that MpCmdRun is not in the PATH, so without this step the command is not recognized.

   cd /d "%ProgramFiles%\Windows Defender"

3. Remove the security intelligence and the engine.

   MpCmdRun.exe -RemoveDefinitions -All

4. Put the platform files back to the version in %ProgramFiles%\Windows Defender.

   MpCmdRun.exe -ResetPlatform

5. Switch Defender on again.

   MpCmdRun.exe -WdEnable

6. Download fresh definitions straight from Microsoft.

   MpCmdRun.exe -SignatureUpdate -MMPC

7. Restart the PC.

Microsoft's own steps start in the newest platform folder under %ProgramData%\Microsoft\Windows Defender\Platform\. Microsoft lists %ProgramFiles%\Windows Defender as the second location of MpCmdRun and uses it when the newer folder does not exist. We use it here because it is the same path on every PC.

Fix 5. Install the latest security intelligence update by hand

5 to 15 minutesNo riskWindows Update shows Install error - 0x800106ba on a Defender update, or definitions are days old.

Once the service runs again, Defender needs current definitions before it scans normally. On 15 October 2026 Microsoft listed security intelligence 1.461.34.0, engine 1.1.26090.9 and platform 4.18.26090.9 as the newest.

1. Open Windows Security and select Virus & threat protection > Protection updates > Check for updates.
2. If that fails, open Settings > Windows Update and select Check for updates. On Windows 10 it is Settings > Update & Security > Windows Update.
3. If the update still fails, open Microsoft's page Latest security intelligence updates for Microsoft Defender Antivirus (link in the sources).
4. Download the file for your Windows. Microsoft names them mpam-fe.exe and mpam-feX64.exe. Choose 64-bit on a 64-bit Windows.
5. Run the downloaded file. Microsoft says you simply launch it to install the latest security intelligence.
6. Open Protection updates again and check the date of the last update.

Windows 10 left support on 14 October 2025. Microsoft still publishes Defender definitions for it, but Windows itself gets no fixes without Extended Security Updates. If a Windows update fails, see Install an update from the Microsoft Update Catalog.

Fix 6. Check for malware that keeps Defender switched off

20 minutes to several hoursNo riskDefender turns itself off again after Fix 2 to Fix 4, or settings change without you.

Stopping the built-in antivirus is a common first move of malware. Microsoft's repair steps include a run of the Microsoft Safety Scanner for this reason, because it works even while Defender is down.

1. Download the Microsoft Safety Scanner from Microsoft's page (link in the sources). Pick the 64-bit file on a 64-bit Windows. Microsoft notes that a download expires 10 days after you get it.
2. Run the downloaded file, select the type of scan and start it. Choose the most thorough type the tool offers.
3. Review the results on screen. Microsoft says the detailed log is %SYSTEMROOT%\debug\msert.log. Restart when asked.
4. Repeat Fix 3 and Fix 4, then check whether Defender stays on after a restart.

Once Defender runs again, run its own full scan as well: How to scan for malware with Microsoft Defender

Fix 7. Repair Windows system files, then repair Windows in place

20 to 90 minutesLow riskFixes 1 to 6 did not help, and other Windows parts fail as well.

Defender relies on Windows services, drivers and the component store. If those are damaged, the service can fail even with clean settings. DISM and SFC repair Windows files, and a repair install replaces Windows while keeping apps and files.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

1. Restart and check Windows Security > Virus & threat protection again.
2. If Defender is still off on Windows 11, open Settings > System > Recovery and select Reinstall now next to Fix problems using Windows Update.
3. Keep the PC plugged in and online until it restarts into Windows.
4. Run Fix 1 once more to confirm that WinDefend is running.

Routes for Windows 10 and the other options: Reinstall Windows without losing files

If 0x800106ba is still there: the logs to read and what to send

When nothing helps, stop changing settings and collect evidence. Defender writes its reasons in two places, and one command packs them into a file for Microsoft support.

• What to send to Microsoft support: the exact message, the output of both commands in Fix 1, the Windows build from winver and the MpSupportFiles.cab file when they ask for it.
• What not to post in public. The CAB file holds logs and system details of your PC. Give it to the person who investigates, not to a public forum.
• The old advice to upload the CAB to the malware submission portal. That portal is for suspicious files. We could not confirm that it accepts Defender log packages today.

How to keep error 0x800106ba from coming back

Windows 11 adds one twist. Microsoft notes that with Smart App Control on, Defender may go to passive mode instead of disabled mode when another antivirus is present. The cure is the same: decide on one antivirus and remove the other.

Frequently asked questions

What does error code 0x800106ba mean?

It means the Microsoft Defender Antivirus service is not running. Microsoft lists the code with the explanation "The Microsoft Defender Antivirus service is disabled. Enable the service and try again." Windows Security, MpCmdRun, the PowerShell Defender commands and Windows Update all pass their work to that service, so all of them fail with this code when it is off. The most common reason is another antivirus, which makes Windows switch Defender off. Policies, tweak tools, a damaged Defender engine or malware are the less common reasons.

How do I fix install error - 0x800106ba in Windows Update?

This message appears on a Security Intelligence update for Microsoft Defender Antivirus. Windows Update downloaded it, but Defender could not take it because its service is off. Retrying the update does not help on its own. First check in Windows Security whether another antivirus is active (Fix 1), and remove it if you want Defender (Fix 2). Then install the update again from Virus & threat protection > Protection updates, or by hand with the mpam-fe file from Microsoft's download page (Fix 5).

Why does Get-MpPreference fail with error 0x800106ba?

Get-MpPreference reads Defender settings from the Defender service. When the service is disabled, the command answers "Operation failed with the following error: 0x800106ba". The same happens with Set-MpPreference, Add-MpPreference and Start-MpScan. On a PC with a third-party antivirus this is normal, because Defender is meant to be off there. In a script, check Get-MpComputerStatus first and skip Defender commands when AMRunningMode is not Normal. If Defender should be the active antivirus, work through Fix 2 to Fix 4.

What does "Signature update failed with hr=0x800106ba" mean?

It is the output of MpCmdRun.exe -SignatureUpdate when the Defender service is not running. The update never starts, so a newer download or a different update source does not help. Users who post this output on Microsoft Q&A usually also see Service Version and Engine Version as 0.0.0.0. Bring the service back first: remove another antivirus (Fix 2), clear Defender policies (Fix 3), or reset the engine and platform (Fix 4). Then run the update again with -SignatureUpdate -MMPC.

Can I keep my other antivirus and fix 0x800106ba?

You can keep it, but then the error is not a fault. Microsoft designed Windows to switch Defender off when a compatible non-Microsoft antivirus is installed, so Defender commands answer with 0x800106ba. Your protection then comes from the other program. Run scans and updates in that program instead. If you want Defender back, Microsoft says it turns on again when the other product is uninstalled, expires or stops giving real-time protection. Do not run two real-time scanners side by side.

Is error 0x800106ba a virus?

The code itself is not a virus. It only says the Defender service is off. In most cases another antivirus or a setting is the reason. Malware is a less common cause, but it does try to stop antivirus software. Suspect it when Defender switches itself off again after you fixed it, or when settings change without you. Scan the PC with the Microsoft Safety Scanner, which runs without Defender (Fix 6), and run a full Defender scan once the service works again.

Why does a Defender full scan stop with 0x800106ba?

The service stopped during the scan. Older Windows Defender then showed "Your PC couldn't be scanned. The program's service has stopped." In 2014 and 2019 faulty Microsoft engine and definition updates caused this on Windows 7 and 8.1, and later updates fixed them. Today a scan that stops this way usually means another security program interfered or the Defender engine is damaged. Check the active antivirus (Fix 1), reset the engine (Fix 4) and update the definitions (Fix 5).

What does errore 0x800106ba or Fehlercode 800106ba mean?

These are the Italian and German ways to write the same code. Errore and Fehlercode both mean error or error code, and 800106ba is 0x800106ba without its prefix. The meaning does not change with the language of Windows: the Microsoft Defender Antivirus service is disabled. The fixes on this page work the same on Windows in any language, although the menu names you see are translated. This page is in English.

Is 0x800706ba the same as 0x800106ba?

No. The two codes differ by one digit and have nothing in common. 0x800706ba is Win32 error 1722, which Microsoft describes as "The RPC server is unavailable". It appears with printers, remote management and some downloads when one Windows component cannot reach another. 0x800106ba belongs to Microsoft Defender and means its service is disabled. If your message about a printer or a download shows 0x800706ba, the fixes on this page do not apply.