How to Disable Microsoft Defender Antivirus in Windows 11 and 10 Safely

Microsoft Defender Antivirus, formerly known as Windows Defender, is the default security component integrated into Windows 11 and Windows 10. It provides real-time protection against malware, ransomware, and various online threats. In most scenarios, Microsoft Defender remains active in the background, consuming minimal resources while maintaining system integrity. However, there are specific situations where users may need to disable it, ranging from software development requirements and hardware benchmarking to the installation of specialized legacy software that triggers false positives.

Disabling Microsoft Defender can be achieved through several methods, depending on whether the requirement is temporary or permanent, and which edition of Windows (Home, Pro, or Enterprise) is in use.

Scenarios for Disabling Windows Security

While maintaining active antivirus protection is a fundamental security practice, several professional and technical environments necessitate the temporary or permanent suspension of Microsoft Defender.

Third-Party Antivirus Installation: When a user chooses a premium security suite such as Bitdefender, Norton, or Kaspersky, Windows is designed to detect the new provider and automatically put Microsoft Defender into "Passive Mode" or disable it entirely to prevent system instability.
Software Development and Compilation: Developers working with large codebases often find that real-time scanning of thousands of small files during compilation significantly increases build times. In some observed environments, the MsMpEng.exe process (the engine behind Defender) can consume up to 30-40% of CPU resources during intense disk I/O operations.
Legacy Software Compatibility: Older applications or proprietary enterprise tools may use execution patterns that modern heuristics identify as suspicious. Disabling the antivirus is sometimes the only way to facilitate the installation or operation of these tools.
Hardware Benchmarking and Optimization: Gamers and hardware enthusiasts seeking the highest possible performance benchmarks often disable all background security services to ensure that the CPU and memory are dedicated entirely to the primary application.

Method 1: Installing Third-Party Antivirus (The Automatic Method)

The most efficient and "official" way to disable Microsoft Defender is to install another reputable antivirus program. Windows is built with an internal mechanism that prioritizes third-party security providers registered with the Windows Security Center.

When a third-party antivirus is installed:

Automatic Handover: The Windows Security Service recognizes the new ELAM (Early Launch Anti-Malware) driver of the third-party software.
Passive Mode: Microsoft Defender will typically move into "Passive Mode." In this state, it does not provide real-time protection and does not interfere with the active antivirus, but it can still be used for manual scans.
Full Disabling: In many cases, the real-time protection toggle in Windows Security will be greyed out, indicating that the third-party software is managing the system's defenses.

This method is recommended for users who do not wish to leave their system vulnerable but prefer a different security interface or feature set.

Method 2: Disabling Real-Time Protection via Windows Security (Temporary)

For users who need to quickly run a specific file or install a program without permanently altering system policies, the Windows Security interface provides a straightforward toggle.

Steps for Windows 11 and Windows 10

Open the Start Menu and type Windows Security, then press Enter.
Navigate to the Virus & threat protection tab represented by a shield icon.
Under the Virus & threat protection settings section, click on Manage settings.
Locate the Real-time protection toggle and switch it to Off.
A User Account Control (UAC) prompt will appear; click Yes to confirm the change.

Technical Note: This method is strictly temporary. Windows identifies this state as a vulnerability and will automatically re-enable Real-time protection after a certain period or upon the next system reboot. To keep it disabled during a long task, the user must monitor this setting periodically.

Method 3: Using Group Policy Editor (Windows Pro and Enterprise)

The Local Group Policy Editor (gpedit.msc) is a powerful tool available in the Pro, Enterprise, and Education editions of Windows. This method provides a more persistent way to disable the antivirus service at the policy level.

Configuration Steps

Press Win + R on the keyboard, type gpedit.msc, and hit Enter.
In the left-hand navigation pane, follow this path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
In the right-hand panel, find the policy named Turn off Microsoft Defender Antivirus.
Double-click this policy to open its configuration window.
Select the Enabled radio button. (Note: Enabling the "Turn off" policy effectively disables the antivirus).
Click Apply and then OK.

Important Prerequisite: Tamper Protection

In modern versions of Windows 10 (version 1903 and later) and all versions of Windows 11, the Group Policy method may appear to fail unless Tamper Protection is disabled first. Tamper Protection is designed to prevent external apps or policy changes from modifying critical security settings. If Tamper Protection is ON, the Group Policy change will be ignored or reverted by the system.

To disable Tamper Protection:

Go to Windows Security > Virus & threat protection > Manage settings.
Scroll down to Tamper Protection and toggle it to Off.

Method 4: Modifying the Windows Registry (For Advanced Users)

Users on Windows Home Edition do not have access to the Group Policy Editor. For these users, the Registry Editor (regedit) serves as the alternative for deep system modification.

Registry Modification Steps

Press Win + R, type regedit, and press Enter.
Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Right-click on the Windows Defender folder (key), select New, and then DWORD (32-bit) Value.
Name the new value DisableAntiSpyware.
Double-click DisableAntiSpyware and set its Value data to 1.
Click OK and restart the computer.

Advanced Implementation: Some environments also require the disabling of specific components within the registry. Users often create a sub-key named Real-Time Protection under the Windows Defender key and add DWORD values such as DisableRealtimeMonitoring, DisableBehaviorMonitoring, and DisableOnAccessProtection, setting all to 1.

Warning: Improperly editing the registry can lead to system instability or boot failures. It is highly recommended to export a backup of the registry key before making changes.

Method 5: Using PowerShell and Command Line Interface

For IT administrators managing multiple workstations or users who prefer command-line automation, PowerShell offers a direct way to interact with the Microsoft Defender preference settings.

PowerShell Commands

Open PowerShell with Administrative privileges and execute the following:

To disable real-time monitoring: Set-MpPreference -DisableRealtimeMonitoring $true
To disable cloud-delivered protection: Set-MpPreference -DisableBlockAtFirstSight $true
To disable IOAV protection (scanning attachments): Set-MpPreference -DisableIOAVProtection $true

To verify the current status of the antivirus via PowerShell, use: Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled

If the output returns False, the real-time protection is successfully suspended. Like the Group Policy method, these commands may be overridden by Tamper Protection if it is active.

Command Prompt (CMD)

The sc (Service Control) command can also be used to interact with the service, though modern Windows versions have placed heavy protections on the WinDefend service, often resulting in an "Access Denied" error even for administrators. sc config WinDefend start= disabled sc stop WinDefend

The Critical Role of Tamper Protection

One of the most frequent complaints from users is that "Windows Defender turns itself back on." This behavior is almost exclusively governed by Tamper Protection. This feature was introduced to combat malicious software that attempts to disable the antivirus to hide its presence.

When Tamper Protection is active:

It protects Registry keys related to security.
It protects Group Policy settings.
It prevents PowerShell commands from changing core security preferences.

Therefore, for any "permanent" manual disabling method to work, Tamper Protection must be disabled in the Windows Security UI first. It cannot be disabled via the registry or command line, as that would defeat its purpose.

Managing Exclusions as an Alternative to Disabling

If the primary reason for disabling Microsoft Defender is performance degradation—particularly during software development, video editing, or database management—disabling the entire suite is often unnecessary. A more balanced approach is the use of Exclusions.

Exclusions allow the user to tell Microsoft Defender to ignore specific files, folders, file types, or processes. This retains the system's overall security while removing the performance bottleneck for trusted activities.

How to Add an Exclusion

Go to Windows Security > Virus & threat protection > Manage settings.
Scroll to the bottom and click Add or remove exclusions.
Click Add an exclusion and choose from File, Folder, File type, or Process.
Select the high-impact directory (e.g., your project's node_modules folder or a local database directory).

By excluding specific processes like git.exe or a compiler's executable, users can often achieve a 20-50% improvement in task speed without turning off the firewall or real-time scanning for the rest of the system.

Risks and Consequences of a Vulnerable System

Disabling Microsoft Defender without a replacement is a high-risk action. Modern cybersecurity threats are not limited to malicious downloads; they include:

Fileless Malware: Threats that exist only in memory and do not rely on traditional files.
Zero-Day Exploits: Vulnerabilities in browsers or document readers that can infect a system simply by visiting a compromised website.
Ransomware: Automated scripts that can encrypt a user's entire drive in minutes.

Without an active antivirus, the system loses its ability to perform behavior monitoring, which is often the last line of defense against previously unknown threats. If a system must be disconnected from security, it should ideally be disconnected from the internet and external USB storage as well.

Conclusion

Disabling Microsoft Defender Antivirus is a multi-step process in modern Windows environments due to layered security features like Tamper Protection. For temporary needs, the Windows Security toggle is the most appropriate tool. For persistent or professional needs, the Group Policy Editor and Registry Editor provide deeper control, provided the user understands the prerequisite of disabling Tamper Protection. However, for the vast majority of performance-related issues, setting up specific exclusions offers a superior balance of speed and safety. Always ensure that the system is re-protected immediately after the specific task requiring the disabling is completed.

FAQ

Why is the "Turn off Microsoft Defender Antivirus" option greyed out?

This usually occurs if your computer is joined to a domain or managed by an organization. Your IT administrator likely has a "Global Policy" in place that prevents users from changing security settings. Additionally, if a third-party antivirus is already installed, Windows may disable manual control of Defender settings to prevent conflicts.

Does disabling Defender also turn off the Firewall?

No. Microsoft Defender Antivirus and Microsoft Defender Firewall are two separate components. Disabling the antivirus real-time protection does not automatically disable the firewall. The firewall settings must be managed separately under "Firewall & network protection" in Windows Security.

Will Windows Update turn Defender back on?

Yes, frequently. Significant Windows Updates or "Feature Updates" often reset security policies to their default values. If you used a registry hack or Group Policy, a major update might revert these changes to ensure the system remains protected.

Is there a way to disable Defender for just one folder?

Yes, using the "Exclusions" feature. This is the recommended method for developers and gamers. Instead of turning off the whole system, you add the specific folder or process to the exclusion list, and Defender will ignore all activity within that specific scope.

Can I disable Microsoft Defender in Windows Home?

Yes, but you must use the Registry Editor method, as the Group Policy Editor is not included in the Home edition. Remember to disable Tamper Protection in the Windows Security settings first, or the registry changes will not take effect.

Is Microsoft Defender good enough to use alone?

In recent years, Microsoft Defender has consistently ranked high in independent lab tests (such as AV-Test and AV-Comparatives), often matching the detection rates of paid products. For most home users, it is considered a very capable and sufficient security solution.