How to Disable Microsoft Defender in Windows 11

Microsoft Defender Antivirus is built into Windows 11 and provides real-time protection against malware, viruses, ransomware, and other security threats. In most situations, it should remain enabled. However, there are times when you may need to temporarily disable Microsoft Defender for troubleshooting, software installation, testing, or compatibility purposes.

Windows 11 includes several security features that make it difficult to permanently turn off Microsoft Defender. Tamper Protection, in particular, is designed to prevent applications and users from changing important security settings without authorization.

If you only need to stop Defender temporarily, Windows Security provides the simplest option. If you are troubleshooting a specific application, adding an exclusion can also be safer than disabling antivirus protection completely.

Before disabling Defender, make sure you understand the security implications and turn protection back on as soon as your task is finished.

Method 1: Temporarily Disable Real-Time Protection

The simplest way to temporarily disable Microsoft Defender is through Windows Security.

1. Press Windows + I to open Settings.
2. Select Privacy & security.
3. Click Windows Security.
4. Select Virus & threat protection.
5. Under Virus & threat protection settings, click Manage settings.
6. Find Real-time protection.
7. Turn the switch Off.
8. Confirm the User Account Control prompt if it appears.

Microsoft Defender will temporarily stop real-time scanning.

This does not uninstall Defender. Windows can automatically turn real-time protection back on later.

Once you have completed your troubleshooting or installation task, return to the same location and switch Real-time protection back on.

Do not leave real-time protection disabled while browsing unfamiliar websites, opening unknown downloads, or using potentially unsafe files.

Method 2: Temporarily Disable Defender Using PowerShell

You can also change Microsoft Defender’s real-time monitoring setting through an elevated PowerShell window.

1. Open Start.
2. Search for PowerShell.
3. Right-click PowerShell.
4. Select Run as administrator.
5. Enter:

Set-MpPreference -DisableRealtimeMonitoring $true

6. Press Enter.

If Windows allows the configuration change, real-time monitoring will be disabled.

To enable it again, run:

Set-MpPreference -DisableRealtimeMonitoring $false

Windows security features can restrict or override this setting. If the command does not produce the expected result, check Windows Security and Tamper Protection.

PowerShell should be used carefully because Defender settings affect the security of the entire computer.

Method 3: Check Tamper Protection

Tamper Protection helps prevent unauthorized changes to Microsoft Defender’s security settings.

If you are troubleshooting Defender and a setting immediately returns to its previous state, check Tamper Protection.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Click Manage settings.
4. Find Tamper Protection.
5. Check whether it is enabled.

For legitimate troubleshooting, you may temporarily change the setting if Windows allows it.

After completing the task, turn Tamper Protection back on.

You should not leave Tamper Protection disabled simply to keep Microsoft Defender turned off. Doing so weakens an important layer of Windows security.

If you only need to prevent Defender from scanning one trusted application or folder, consider an exclusion instead.

Method 4: Add an Exclusion Instead of Disabling Defender

If Microsoft Defender is interfering with a trusted application, you may not need to disable the entire antivirus.

Windows Security allows you to create exclusions for specific files, folders, file types, or processes.

1. Open Windows Security.
2. Select Virus & threat protection.
3. Click Manage settings.
4. Scroll down to Exclusions.
5. Select Add or remove exclusions.
6. Click Add an exclusion.
7. Select the appropriate type.
8. Choose the trusted file, folder, or application.

An exclusion limits Defender’s scanning in the selected location instead of turning off protection for the entire system.

Only add exclusions for files and locations that you completely trust. Malware stored in an excluded location may not be detected by Defender in the normal way.

Avoid excluding your entire drive or large system directories simply to improve performance.

Method 5: Disable Microsoft Defender Through Group Policy

Windows Pro, Enterprise, and Education editions provide additional administrative controls through Local Group Policy.

If you are managing a computer in an environment where Defender needs to be configured centrally, Group Policy can be used to manage Microsoft Defender Antivirus.

To locate the relevant policy:

1. Press Windows + R.
2. Type:

gpedit.msc

3. Press Enter.
4. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

5. Review the available Microsoft Defender policies.

Some Windows versions and security configurations may prevent the traditional “Turn off Microsoft Defender Antivirus” policy from permanently disabling Defender, particularly when modern security protections are active.

Group Policy changes should therefore be used according to your organization’s security requirements rather than as a guaranteed permanent workaround.

After testing, return the policy to its previous configuration when appropriate.

Method 6: Turn Off Defender When Installing a Trusted Application

Sometimes users want to disable Defender because a legitimate installer is being blocked or quarantined.

Do not immediately disable antivirus protection just because an installer produces a warning.

First verify that:

• You downloaded the installer from a legitimate source.
• The application publisher is known.
• The file has not been modified.
• The warning is not identifying actual malware.

If the file is trusted and Defender is producing a false positive, check whether the software publisher has an updated version.

If you still need to temporarily disable real-time protection for testing, use:

Windows Security > Virus & threat protection > Manage settings > Real-time protection

Turn it off only for the duration of the installation or troubleshooting task.

Then immediately turn it back on.

If the same application repeatedly triggers Defender, an appropriately scoped exclusion may be preferable to repeatedly disabling antivirus protection.

Method 7: Disable Defender When Another Antivirus Is Installed

Windows 11 is designed to work with third-party antivirus software.

When a compatible third-party antivirus product is installed and registered with Windows Security, Microsoft Defender Antivirus can change its operating mode rather than continuing to provide the same type of active protection.

If you are installing another antivirus application:

1. Download it from the vendor’s legitimate source.
2. Install the application.
3. Restart Windows if requested.
4. Open Windows Security.
5. Select Virus & threat protection.
6. Check which antivirus provider Windows reports as active.

Avoid installing multiple antivirus products that attempt to provide simultaneous real-time protection. They can interfere with each other and cause unnecessary resource usage.

If you remove the third-party antivirus later, check Windows Security to make sure Microsoft Defender protection is active again.

Method 8: Re-enable Microsoft Defender After Troubleshooting

After completing the task that required Defender to be disabled, restore your security settings.

Open:

Windows Security > Virus & threat protection > Manage settings

Make sure these protections are enabled as appropriate:

• Real-time protection
• Cloud-delivered protection
• Automatic sample submission
• Tamper Protection

If you used PowerShell to disable real-time monitoring, run:

Set-MpPreference -DisableRealtimeMonitoring $false

Then open Windows Security and verify that protection is active.

You can also restart the computer and check Windows Security again.

Do not assume that Defender has automatically returned to normal simply because the Windows Security window has closed.

Why Does Windows 11 Keep Turning Defender Back On?

Windows 11 is designed to maintain antivirus protection.

If you temporarily disable real-time protection, Windows may enable it again automatically. This behavior helps prevent users and malicious software from leaving the computer unprotected indefinitely.

Tamper Protection can also prevent certain security settings from being changed.

Therefore, if your objective is to permanently disable Defender, you may find that Windows restores some protections.

This is expected behavior rather than necessarily a malfunction.

If Defender is causing high CPU or disk usage, investigate the cause instead of repeatedly trying to disable it.

Check Task Manager, Windows Update, active scans, and applications that are generating large numbers of files. A targeted exclusion may also solve a specific compatibility or performance problem.

Is It Safe to Disable Microsoft Defender?

Temporarily disabling Defender on a trusted computer for a specific troubleshooting task can be reasonable when you understand the risk.

Leaving the computer without active antivirus protection for an extended period is different.

When Defender is disabled, malicious files may not be detected or blocked in real time.

If you must disable protection:

1. Complete the required task quickly.
2. Avoid unknown downloads.
3. Do not open suspicious attachments.
4. Keep the computer disconnected from untrusted networks when practical.
5. Re-enable protection immediately afterward.

For everyday use, keeping antivirus protection enabled is the safer configuration.

What If Microsoft Defender Cannot Be Disabled?

If the Real-time protection switch is unavailable or immediately turns itself back on, Windows may be enforcing the setting through Tamper Protection, organizational policies, or another security configuration.

If the computer belongs to an employer, school, or organization, an administrator may have deliberately restricted changes to Defender.

In that situation, do not attempt to circumvent the organization’s security controls.

For a personal computer, check Windows Security, installed antivirus software, Windows Update, and the available Defender policies.

If you are trying to solve a performance problem, focus on the underlying cause instead of forcing Defender to remain disabled.

Conclusion

Microsoft Defender is an important security component in Windows 11, and there are legitimate situations where you may need to temporarily turn off its real-time protection. The simplest option is Windows Security > Virus & threat protection > Manage settings > Real-time protection.

PowerShell and administrative policies provide additional configuration options, but modern Windows security features such as Tamper Protection can prevent some changes from remaining in effect. This is intentional because Windows is designed to keep antivirus protection active whenever possible.

If Defender is interfering with a trusted application, consider adding a narrowly targeted exclusion instead of disabling the entire antivirus. If you install a compatible third-party antivirus program, Windows can also adjust its security configuration accordingly.

Most importantly, do not leave Microsoft Defender disabled without a good reason. Once your installation or troubleshooting task is complete, turn real-time protection and other relevant security protections back on. If Defender is causing unusually high CPU, memory, or disk usage, investigate the underlying problem rather than treating permanent antivirus deactivation as the solution.

FAQs

1. How do I temporarily disable Microsoft Defender in Windows 11?

Open Windows Security > Virus & threat protection > Manage settings and turn Real-time protection off. Windows may automatically turn it back on later.

2. Why does Microsoft Defender turn itself back on?

Windows 11 is designed to restore antivirus protection after temporary changes. Security features such as Tamper Protection can also restrict modifications to Defender settings.

3. Can I permanently disable Microsoft Defender?

Windows 11 is designed to prevent casual permanent deactivation of its built-in antivirus protection. The available behavior also depends on your Windows edition, security settings, organizational policies, and whether another antivirus is installed.

4. Is it better to create an exclusion than disable Defender?

For a trusted application or folder that is causing a specific problem, a narrowly scoped exclusion can reduce scanning activity without disabling antivirus protection across the entire computer.

Quick Summary

• Use Windows Security to temporarily turn off Microsoft Defender’s real-time protection.
• PowerShell can also change Defender’s real-time monitoring setting when permitted.
• Use a specific exclusion when only one trusted application or folder is causing a problem.
• Re-enable Defender and Tamper Protection after troubleshooting is complete.