How to turn off real-time protection in microsoft defender on windows 10

Source: Windows Central

Windows 10 comes with Microsoft Defender Antivirus to protect your device and files against unwanted viruses, ransomware, spyware, rootkits, and other forms of malware and hackers. Although it offers robust protection, the anti-malware sometimes can interfere with certain tasks even though they’re safe. For example, the feature may block a specific file that you’re trying to open and you know is safe, or it can prevent the installation of an app that you know comes from a trusted source.

If you must perform a task that is getting blocked by the default antivirus, on Windows 10, there are at least two ways to temporarily disable the Microsoft Defender protection using Windows Security and PowerShell.

In this Windows 10 guide, we’ll walk you through the steps to temporarily disable the real-time protection on Microsoft Defender Antivirus.

How to disable Microsoft Defender protection using Windows Security

To disable the real-time protection on Microsoft Defender, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.

Under the “Virus & threat protection settings” section, click the Manage settings option.

Source: Windows Central

Turn off the Real-time protection toggle switch.

Source: Windows Central

Once you complete the steps, the Microsoft Defender Antivirus protection will temporarily disable, allowing you to complete a specific task, which otherwise will be blocked by the antivirus.

If you want to re-enable the protection, you can either restart the computer or use the same instructions outlined above, but on step No. 5, make sure to turn on the Real-time protection toggle switch.

In the case that you’re trying to disable the Windows 10 default antivirus permanently, you can use these instructions.

How to disable Microsoft Defender protection using PowerShell

Microsoft Defender Antivirus ships with a command to temporarily disable real-time protection, but the “Tamper Protection” feature shields any attempt to modify the antivirus settings from outside of Windows Security. This means that if you want to use PowerShell to turn off the feature, you first need to disable Tamper Protection on Windows Security > Virus & threat protection > Virus & threat protection settings.

To disable the Windows 10 antivirus real-time protection with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and select the Run as administrator option.

Type the following command to disable Microsoft Defender Antivirus real-time protection and press Enter:

Set-MpPreference -DisableRealtimeMonitoring $true

Source: Windows Central

After you complete the steps, the protection will be disabled until the next time you restart the device or run the command to enable real-time protection: Set-MpPreference -DisableRealtimeMonitoring $false .

You can also manage virtually any aspect of the Microsoft Defender Antivirus using PowerShell commands. You can check this guide to learn more.

More Windows 10 resources

For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:

Best Destiny 2 builds, and how to make your own

Destiny 2’s sandbox has become both wider and deeper than ever before, and as a result, players have the tools to create some very effective builds in both PvE and PvP. Here’s an overview of the best ones, as well as a guide on how you can start creating your own builds.

All the Xbox Game Pass games coming and leaving soon

Xbox Game Pass is constantly evolving with new games joining the service all the time. Keep track of everything coming and going from Xbox Game Pass with our comprehensive guide.

Which XPS 15 display is best for you?

While the laptops look the same and have mostly the same features, there are some key differences to know about when choosing between the FHD+, 3.5K OLED, and UHD+ XPS 15 9510 models.

The NFL is back! Check out these must-have Windows apps for football fans

After months of waiting through the offseason, the NFL is finally back this week. With these Windows 10 apps, you won’t miss a snap of the NFL action.

Asa pre-installed anti-virus software, Windows Defender does an excellent job ofkeeping your PC safe from spyware, viruses, ransomware, and other threats.

Butthere are times when you’d want to temporarily or permanently disable thissoftware. For instance, specific tasks might be conflicting with the Defender,and you need to disable it to complete the action.

Nevertheless, permanently disabling Windows Defender can be challenging if you’re not using Windows 10 Pro. Let’s dive in.

Turning Off Windows Defender

There are two ways to temporarily turn off the Defender – via Windows Security and via Group Policy. The following sections cover both methods.

Windows Security

Step 1

Launch the Start menu, type Windows Security into the search bar, and click on the top result.

Make sure “Virus & threat protection” is selected, then click on “Manage settings” under “Virus & threat protection settings.”

Step 2

To turn off Windows Defender, click on the button under “Real-time protection” to toggle it off. The action enables you to install any software and make the needed system changes, which the anti-virus previously blocked.

Of course, you can always re-enable the protection by taking the same steps.

Group Policy

Ifyou’re using Windows 10 Pro, Local Group Policy Editor allows you to turn offWindows Defender permanently.

To complete the action, you need to turn off Tamper Protection first. Available since May 2019, this feature safeguards your system from unauthorized changes. To stress, the Defender will turn back on after a restart if you don’t disable Tamper Protection.

Step 1

Navigate to Windows Security, select “Virus & threat protection,” and select “Manage settings” under “Virus & threat protection settings.”

Step 2

In the following window, go to Tamper Protection and click on the button to toggle it off. Now, you can access Group Policy to disable the native anti-virus altogether.

Step 3

Goback to the Start menu and look for gpedit.mscto locate Local Group Policy Editor. Then, you need to take the followingpath:

Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus

Step 4

Double-click “Turn off Windows Defender Antivirus” to access more actions. Then, choose “Enabled” to turn off Windows Defender. This action might appear counter-intuitive, but the Help section informs you that it’s the right thing to do.

Afterward, select Apply, then OK for the actions to take effect. You can now close the remaining windows and restart your PC.

Important Notes

Afterthat, the built-in anti-virus will remain off indefinitely, but you’ll still beable to see the shield icon in the taskbar. That’s not a surprise because theicon is associated with Windows Security.

To enable the anti-virus, retrace your steps as previously described. But now, you need to select “Not Configured” instead of “Enabled.” You also need to reactivate Tamper Protection and restart your PC for the changes to take effect.

Bonus Method

If you’re not running Windows 10 Pro, you might not be able to access the Local Group Policy Editor. However, you can use Windows Registry to remove Windows Defender permanently.

Step 1

Startby disabling Tamper Protection.

Keepin mind that there is a “TamperProtection Registry” key, and you can find it inthe following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsDefender\Features

You can easily control this key, but it’s quite tricky to modify it. That’s why it’s not advisable to try to turn off Tamper Protection using the key.

Step 2

Hitthe Start menu, type regedit, andaccess the first option that pops up. Thereon, navigation is as follows.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsDefender

Once there, right-click Windows Defender (it’s a folder), choose New, then select DWORD (32-bit) Value.

Step 3

Type DisableAntiSpyware under Value Name, and hit Enter. Then, select the Value Data box and change the value to 1. Click OK and restart your PC.

Things to Know

RemovingWindows Defender disables native anti-virus protection on your computer. Butit’s OK as long as you’re using some third-party solution.

Tore-enable the Defender from Windows Registry, repeat the steps from theprevious section. Then, locate the DisableAntiSpywre key, and delete it fromthe system.

Asof May 2020, Windows Defender is known as Windows Defender Antivirus. However,the changes in the name do not affect the actions or required steps to disableit.

After a significant software update, the Defender might turn back on. If so, repeat the steps from above to turn it off.

Safety First

DisablingWindows Defender entirely takes more than a few steps indeed. Albeit a bittedious, this action requires very little advanced knowledge of the system.

Whydo you want to disable Windows Defender? Did you notice your PC is slower withthe anti-virus software running in the background? Tell us more about yourexperience in the comments section below.

You just had an update and it’s messed with my computer. I use NIS for firewall and other security. The update added the Defender icon to my systray. When I was looking at how to get rid of it, it seems to have turned on the firewall and I can’t turn it off. I don’t need competing firewalls and I trust Norton far more than I trust you.

How do I turn off Defender and how do I get it to disappear from the systray so it’s not telling me to turn more of it on?

***Post moved by the moderator to the appropriate forum category.***

• Subscribe
• Subscribe to RSS feed

Report abuse

Replies (4) 

You can disable Windows Defender through your computer settings. To disable Windows Defender, kindly follow these steps:

1. Type settings on the search bar.
2. Click on Settings.
3. Click on Update & security.
4. On the left panel, click on Windows Defender, then click on Turn off Windows Defender.

Let us know if you need further assistance with your concern.

Report abuse

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Nope. It’s already turned off there. The only button on that page is to turn on Defender.

So how do I get rid of the “Actions recommended” that’s annoyingly showing in the systray and where do I turn off the firewall it seems to have turned on?

Report abuse

1 person found this reply helpful

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

We just want to remind you that it’s better to run Windows firewall even if you have another firewall turned on to make sure that your device is well protected from unauthorized access. If you really want to turn it off, you can turn it off by following the steps in this article: Turn Windows Firewall on or off. Remember to read the “note” in the article before proceeding with the steps.

Regarding your concern about getting notifications for recommended actions turned off, kindly follow the steps in this article: Change notification settings in action center. You could also disable Windows Defender in your PC’s startup programs. To do so, kindly follow the steps in this article: Change startup apps in Windows 10.

Windows Security and Windows Defender protect your computer in real-time from viruses, ransomware, and more. There are times that you need to disable Defender, usually, because of a blocked file or website you know is safe. In this tutorial, we give you a few options to temporarily disable Windows Defender real-time protection.

TIP : Hard to fix Windows Problems? Repair/Restore Missing Windows OS Files Damaged by Malware with a few clicks

We have numerous options so you can choose the best way to enable or disable real-time protection.

1: Windows Security Setting
2: Edit the Registry or Use Registry Files
3: Group Policy Editor
4: PowerShell or Command Prompt

1: Windows Security Settings

Click on Windows Security in the system tray found in the lower-right corner of your screen. Click on Virus & threat protection and on the next screen, click on Manage settings under Virus & threat protection.

Toggle On or Off under Real-time protection. Click

Turning real-time protection back on is as easy as clicking on the Windows Security tray icon again and click Turn on. You can also click on the notification that popped up to quickly enable real-time protection again.

2: Registry Files

You can edit the registry, or download the registry files to do the work for you.

Open the Registry Editor and go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.

Right-click on the right window and select New > DWORD > 32-bit Value. Name the new DWORD DisableRealtimeMonitoring.

Set the Value data to 1 to disable and delete the DWORD you created to enable.

3: Group Policy Editor

Expand Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Real-time Protection.

Double-click Turn off real-time protection. Click Enable to turn real-time protection off and Not configured to turn real-time protection on.

4: PowerShell or Command Prompt

There are two commands each to turn real-time protection on or off. Open either PowerShell or the Command Prompt.

While these commands have been around for years, they didn’t work for us when testing for this tutorial.

Command Prompt:
On – PowerShell Set-MpPreference -DisableRealtimeMonitoring 0 or PowerShell Set-MpPreference -DisableRealtimeMonitoring $false

Off – PowerShell Set-MpPreference -DisableRealtimeMonitoring 1 or PowerShell Set-MpPreference -DisableRealtimeMonitoring $true

PowerShell:
On – Set-MpPreference -DisableRealtimeMonitoring 0 or Set-MpPreference -DisableRealtimeMonitoring $false

Off Set-MpPreference -DisableRealtimeMonitoring 1 or Set-MpPreference -DisableRealtimeMonitoring $true

Microsoft’s Windows 10 Defender offers real-time virus and malware protection to keep your PC safe. It is the best and most easily recommended anti-virus available — that is t say — if you don’t use Windows, you don’t need another. However, there are some edge cases where you may need to disable Defender to accomplish some task or the other that your PC isn’t letting you do. Here’s how to go about it.

How to disable and re-enable Windows Defender on Windows 10 using Windows Security

1. Open Start > Windows Security
2. Click on Virus and Threat Protection
3. Under Virus and Threat Protection Settings, click on Manage Settings
4. Real-Time Protection is the option you’re looking for, toggle that off.
5. To re-enable it, repeat steps 1 – 4 again but toggle it on at the end.

How to permanently disable Windows 10’s Defender using the registry

1. Open the Registry Editor by searching regedit in the Search Bar.
2. Copy and paste the following into the new address bar (if you’re on an older device, simply navigate to it manually): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
3. Right-click on the Windows Defender folder icon and select New > DWORD
4. Name that key DisableAntiSpyware and save it
5. Double click the DWORD to open up a pop-up and change the DWORD value from 0 (disabled) to 1 (enabled)
6. Save your changes and restart your PC to apply them. To revert, simply repeat the steps but change the DWORD value back to 0.

Remember, it is best not to keep Windows’ Real-time Protection off for too long. Turn it off for as long as you need to, but not a milli-second longer.

In one of our previous article, we have explained how you can disable windows updates completly in Windows 10, now in this article, I have provided steps to disable or turning off real time protection in Windows 10.

Before you Turn Windows Defender Off, you should know, this is default app to manage security of your windows and it defends your PC in real-time from threats like Virus, Malwares etc, to your PC safe.

Turn off Real Time Protection in Windows 10 using Security Settings

1. Open Settings -> Windows Security -> Click “Virus & Threat Protection”, as shown in the below image
   
2. Under “Virus and Threat Protection Settings, click on “Manage Settings”
3. You will “Real-Time Protection” checkbox, which is by default Turned On (Blue color background), click on it to Turn it Off.
4. That’s it, your Real-time protection is Turned Off, you can Turn it On again by setting Toggle to On.

Note: If you are using any Anti-Virus Software, then Real-Time proctection is handled by that Software, like Avira-Antivirus and you need to Disable Real-time protection using it.

Disable Real-time Protection using RegEdit

1. Open up the registry editor with Start -> In the Search type “Regedit”, select the first result.
2. Navigate to Computer -> HKEY_LOCAL_MACHINE -> SOFTWARE -> Policies -> Microsoft -> Windows Defender
3. Navigate to Real-Time Protection. If the key doesn’t exist, create it under the Windows Defender folder. (Note, the space between “Time” and “Protection”)
4. Inside Real-Time Protection, add a new DWORD value.
5. Name it DisableRealtimeMonitoring and give it a value of 1.
6. Once done, Reboot your System

By Using above RegEdit steps, you will disable Real-Time protection of Windows Defender. It will alow Windows Defender to run on-demand, but in settings you can check, Real-time protection is turned Off.

Note: In newer version of Windows 10, Tamper Protection was added by Microsoft, which may prevent you from disabling Real-time protection, so you must turn-off Tamper proctection first, otherwise group policy will be ignored.

Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.

These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as autostart extensibility points, or ASEPs), and other changes to the file system or file structure.

Enable and configure always-on protection in Group Policy

You can use Local Group Policy Editor to enable and configure Microsoft Defender Antivirus always-on protection settings.

To enable and configure always-on protection:

Open Local Group Policy Editor, as follows:

In your Windows 10 or Windows 11 taskbar search box, type gpedit.

Under Best match, select Edit group policy to launch Local Group Policy Editor.

In the left pane of Local Group Policy Editor, expand the tree to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.

Configure the Microsoft Defender Antivirus antimalware service policy settings, as follows:

In the Microsoft Defender Antivirus details pane on right, double-click the policy setting as specified in the following table:

Configure the setting as appropriate, and select OK.

Repeat the previous steps for each setting in the table.

Configure the Microsoft Defender Antivirus real-time protection policy settings, as follows:

In the Microsoft Defender Antivirus details pane, double-click Real-time Protection. Or, from the Microsoft Defender Antivirus tree on left pane, select Real-time Protection.

In the Real-time Protection details pane on right, double-click the policy setting as specified in Real-time protection policy settings (later in this article).

Configure the setting as appropriate, and select OK.

Repeat the previous steps for each setting in the table.

Configure the Microsoft Defender Antivirus scanning policy setting, as follows:

From the Microsoft Defender Antivirus tree on left pane, select Scan.

In the Scan details pane on right, double-click the policy setting as specified in the following table:

Configure the setting as appropriate, and select OK.

Close Local Group Policy Editor.

Real-time protection policy settings

Disable real-time protection in Group Policy

Disabling real-time protection drastically reduces the protection on your endpoints and is not recommended.

The main real-time protection capability is enabled by default, but you can disable it by using Local Group Policy Editor.

To disable real-time protection in Group policy

Open Local Group Policy Editor.

1. In your Windows 10 or Windows 11 taskbar search box, type gpedit.
2. Under Best match, select Edit group policy to launch Local Group Policy Editor.

In the left pane of Local Group Policy Editor, expand the tree to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection.

In the Real-time Protection details pane on right, double-click Turn off real-time protection.

In the Turn off real-time protection setting window, set the option to Enabled.

Windows Defender, the built-in antivirus program for Windows operating system has been renamed by Microsoft as Microsoft Defender from Windows 10 Version 2004. Windows 10 has incorporated advanced security features, which proactively takes care of your PC from a plethora of malware and other security threats. Microsoft Defender is an important and exceptionally strong combat system of Microsoft Defender Advanced Threat Protection. IT deploys some cutting-edge technologies like machine learning, big data, threat resistance technology and cloud infrastructure for protecting your Windows 10 devices.

Some significant protection services include cloud delivered protection, behavioral heuristic and real time protection, and periodic and timely protection and updates. The real time protection aids spontaneous scanning in real time using process behavior monitoring, suspicious apps blocking, etc. Cloud based platform includes near distant detection and blocking any new on-setting threat. Microsoft Defender, besides providing real time protection, also updates itself in the background and increases its potential to fight against different forms of threats, including ransomware. It can detect any malicious activity such as unexpected changes in an app, or settings, modification of auto startup reg keys, etc.

However, if you want, you can turn off Microsoft Defender real time protection. But turning off is temporary and if the service is left turned off for a specified period of time, it turns back on. In this article, I shall show you how to turn on/off Microsoft Defender in Windows 10.

Steps To Turn ON/OFF Real-time Protection for Microsoft Defender On Windows 10

Open Windows Search panel, and type Windows Security. Select the Windows Security app.

Next, go to Virus and Threat Protection in the left panel.

Next, click on Manage Settings under the Virus and Threat Protection option.

In the right panel, you will find Real-Time Protection. By default, it is turned on.

Click on the slider, to turn it OFF.

That’s all! If you want to turn it on, you can follow the same steps, and click on the slider corresponding to Real-time protection and turn it on.

I like to disable Windows Defender Real Time Protection via GPO on Windows 10 Pro. When I configure GPO, Real-Time Protection is shown as off. However after a reboot the Protection is magically enabled again.

GPO settings have not changed. I am trying to disable Real Time Protection to be able to analyze and reverse engineer malware.

In addition even if Windows tells me Real Time Protection is managed by the administrator it is still enabled in the back.

I really wonder if there is a way to completely disable Windows Defender + Real Time Protection or if Microsoft made this impossible.

5 Answers 5

In newer versions of Windows, Group Policy settings for Microsoft Defender are reverted back.
To prevent this, before changing them:

1. Open Resource Monitor (type resmon.exe in the search box)
2. Overview
3. Find MsMpEng.exe in the list
4. Right-click > Suspend Process

In newer versions of Windows, Tamper Protection was added.
Tamper Protection must be disabled before changing Group Policy settings, otherwise these are ignored.

1. Open Windows Security (type Windows Security in the search box)
2. Virus & threat protection > Virus & threat protection settings > Manage settings
3. Switch Tamper Protection to Off

To permanently disable real-time protection:

1. Open Local Group Policy Editor (type gpedit.msc in the search box)
2. Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. Enable Turn off real-time protection
4. Restart the computer

To permanently disable Microsoft Defender:

1. Open Local Group Policy Editor (type gpedit.msc in the search box)
2. Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
3. Enable Turn off Microsoft Defender Antivirus
4. Restart the computer

• Regedit.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
• New > DWORD DisableAntiSpyware
• Set it to 1
• Reboot

If it doesn’t work then one more step:

• Regedit.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection (create this key if not existing)
• New > DWORD DisableBehaviorMonitoring ; set it to 1
• New > DWORD DisableOnAccessProtection ; set it to 1
• New > DWORD DisableScanOnRealtimeEnable ; set it to 1
• Reboot

You can also save the code below to disable_realtime_protection.reg and run

I tried all suggestions here prior to today and tried this, this, this.

The only thing that works right now, Jan 2021, is a version of this. I have to run this every time I boot Windows 10. Sometimes even during the day, Defender will enable itself. Argh! So i have to run it again. Because of all this manual labor, I set up a Shortcut Key Ctrl + Shift + Alt + F12 to run the disable command. After pressing that shortcut I have to still answer Yes to the "Allow this program to make changes" dialog.

1. Right click on your desktop then select New then Shortcut. Leave this on your desktop so that Windows finds the shortcut key.
2. In the Target box type this code.

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true

1. In the Shortcut key box press any key you want to use to run this shortcut. I used Ctrl + Shift + Alt + F12.

1. Press Advanced then enable Run as administrator.

1. Press OK twice. You’re done.

You should know that Windows will keep annoying you with notifications to turn on virus protection. It’s non stop madness . in the battle to reclaim CPU power from the sharp clutches of Mr. Evil Real-time Defender of MS. Just ignore it.

I hope MS sees this and fixes this because it’s so obtrusive of them to force real-time defender on all the time. It grinds my fast computer to a crawl.