Defender Event ID 5001: defender real-time protection disabled
What Defender Event ID 5001 (defender real-time protection disabled) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Defender Event ID 5001 means real-time protection was turned off. Ransomware operators and intrusion kits commonly try to disable Defender before running their tools, so on a machine where Defender is the only antivirus this event deserves the same urgency as a detection. The event itself is short; the context around it is what you investigate.
The fields that matter
| Field | What it tells you |
|---|---|
| Product Name / Version | Which Defender component reported it. |
| Time | The key field: line it up with process creation, logons and Defender configuration changes (5007) around the same moment. |
What is normal
A third-party antivirus taking over (Defender moves to passive mode), or an admin turning it off briefly while troubleshooting, with a ticket.
When Defender Event ID 5001 is suspicious
- No other antivirus is installed, and nobody in IT made the change.
- Process creation just before showing
Set-MpPreference -DisableRealtimeMonitoring $true,sc stop WinDefendor registry edits underPolicies\Microsoft\Windows Defender. - Defender Event ID 5007 adding exclusions (paths, extensions or processes) around the same time.
- Tools or unknown programs running in the minutes after protection went off.
Common false positive: Installing another antivirus or EDR product can switch Defender's real-time protection off as designed. Check what else is installed before escalating.
Find Defender Event ID 5001 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=5001; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
Event
| where TimeGenerated > ago(7d) and EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 5001
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated descRelated events
- Defender Event ID 1116: Defender detected malware
- PowerShell Event ID 4104: PowerShell script block logged
- Sysmon Event ID 1: process creation
- Event ID 4688: New process created
FAQ
How do I stop users or malware turning off Defender?
Turn on Tamper Protection (in the Defender for Endpoint portal or Intune). It blocks changes to real-time protection and other key settings, even from local admins.
Which Defender event shows configuration changes?
Event ID 5007 records each change, with the old and new value, including new exclusions.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.