Windows Defender, now officially known as Microsoft Defender Antivirus, is a robust, built-in security layer integrated deep within the Windows operating system. While it provides excellent baseline protection for most users, there are specific scenarios where you might need to disable it. Perhaps you are a developer whose compilation processes are being slowed down by real-time scanning, or maybe you are an IT enthusiast installing specialized software that triggers false positives.

Regardless of the reason, turning off Windows Defender is a multi-layered process. Since the release of the "Tamper Protection" feature, Microsoft has made it increasingly difficult to disable security features through simple registry hacks or scripts. This guide provides a detailed walkthrough of how to disable Windows Defender temporarily or permanently, covering every version of Windows currently in use.

The Essential Prerequisite: Disabling Tamper Protection

Before attempting any permanent disabling method—whether through the Registry Editor or Group Policy—you must disable Tamper Protection. Introduced in later versions of Windows 10 and fully integrated into Windows 11, Tamper Protection is a security feature designed to prevent malicious apps (or unauthorized users) from changing important Microsoft Defender Antivirus settings.

In our practical testing across various builds, we found that if Tamper Protection remains enabled, any changes made via the Registry or Group Policy will be silently ignored or reverted almost instantly by the system's security kernel.

How to Disable Tamper Protection

  1. Open the Start menu and type Windows Security, then press Enter.
  2. Click on Virus & threat protection in the left-hand sidebar or the main dashboard.
  3. Scroll down to find the Virus & threat protection settings section and click on Manage settings.
  4. Locate the Tamper Protection toggle.
  5. Switch the toggle to Off.
  6. A User Account Control (UAC) prompt will appear; click Yes to confirm the change.

Once this is off, the system will allow more advanced administrative changes to the security suite. Note that Windows will likely display a persistent notification warning you that your device is vulnerable; this is normal when security features are manually suppressed.

How to Temporarily Disable Windows Defender Real-Time Protection

If your goal is simply to install a specific program or run a script that Defender is blocking, a temporary disable is the safest and most efficient route. This method does not require deep system modifications and will automatically reset itself after a system reboot or after a certain period of inactivity.

Steps for Windows 10 and 11

  1. Navigate to Windows Security > Virus & threat protection > Manage settings.
  2. Locate the Real-time protection toggle at the top of the menu.
  3. Switch it to Off.
  4. You may also want to disable Cloud-delivered protection and Automatic sample submission if you are working with proprietary code that you do not want Microsoft to analyze.

When Real-time protection is off, files you open or download will not be scanned for threats. However, scheduled scans will still run if the system remains on for a long period. We have observed that Windows typically re-enables this setting automatically within a few hours or immediately upon the next login session to ensure the user doesn't remain unprotected indefinitely.

How to Permanently Disable Windows Defender via Group Policy

For users running Windows 10 Pro, Enterprise, or Education editions, the Local Group Policy Editor (gpedit.msc) is the most reliable way to permanently disable the antivirus engine. This method is preferred by IT administrators because it operates at the policy level, which sits above individual user settings.

Detailed Configuration Steps

  1. Press Win + R on your keyboard to open the Run dialog box.
  2. Type gpedit.msc and hit Enter.
  3. In the left-hand navigation pane, follow this path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
  4. On the right-hand side, find the entry titled Turn off Microsoft Defender Antivirus.
  5. Double-click this policy to open its settings window.
  6. Select the Enabled radio button. (Note: It may seem counterintuitive to select "Enabled" to turn something off, but you are "Enabling" the "Turn off" policy).
  7. Click Apply and then OK.
  8. Restart your computer to finalize the policy application.

In our lab environments, we've noticed that even after enabling this policy, the Windows Security icon might still appear in the system tray. This is because the Windows Security App is a separate interface from the Defender Antivirus Engine. While the engine is dead, the interface remains as a shell for other security features like Firewall and Account protection.

How to Permanently Disable Windows Defender via Registry Editor

If you are using Windows Home Edition, the Group Policy Editor is not available. In this case, you must modify the Windows Registry. The Registry is the central database for all system configurations, and editing it incorrectly can lead to system instability. We strongly recommend creating a System Restore point before proceeding.

Registry Modification Process

  1. Press Win + R, type regedit, and press Enter.
  2. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
  3. If you do not see a value named DisableAntiSpyware in the right-hand pane, you must create it:
    • Right-click an empty space and select New > DWORD (32-bit) Value.
    • Name it DisableAntiSpyware.
  4. Double-click DisableAntiSpyware and change its Value data to 1.
  5. For newer versions of Windows, you may need to add additional values to ensure the service stays down. Right-click the Windows Defender key (folder) and select New > Key. Name it Real-Time Protection.
  6. Inside this new Real-Time Protection key, create the following DWORD values and set each of their values to 1:
    • DisableRealtimeMonitoring
    • DisableBehaviorMonitoring
    • DisableOnAccessProtection
    • DisableScanOnRealtimeEnable
  7. Close the Registry Editor and Restart your PC.

From our experience with Windows 11 Home editions, Microsoft occasionally resets these registry keys during major feature updates (like the jump from 22H2 to 23H2). If you find Defender has "resurrected" itself after an update, you will need to re-verify these registry entries.

Using PowerShell for Advanced Disablement

For system administrators managing multiple machines or users who prefer a command-line interface, PowerShell offers a direct way to interact with the Defender preferences. This is often faster than clicking through multiple GUI menus.

The PowerShell Command

  1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
  2. To disable real-time monitoring, execute the following command: Set-MpPreference -DisableRealtimeMonitoring $true
  3. If you want to disable the entire suite of features (Cloud protection, etc.), you can run: Set-MpPreference -DisableCloudProtection $true Set-MpPreference -DisableIOAVProtection $true

However, there is a catch. In our testing on Windows 11, the Set-MpPreference command is often blocked by Tamper Protection even if you are running as an Administrator. You must ensure the GUI-based Tamper Protection toggle is off before these commands will have any lasting effect.

Why Does Windows Defender Keep Turning Back On?

One of the most common complaints from users is that Windows Defender re-enables itself even after they followed "permanent" disablement steps. This usually happens for three reasons:

  1. Tamper Protection was Active: As mentioned, this is the most frequent culprit. It acts as a watchdog that reverts unauthorized changes to the Registry or GPO.
  2. Windows Updates: Microsoft views an unprotected PC as a liability to the broader internet ecosystem (as it could become part of a botnet). Therefore, major system updates often include "repairs" that reset security settings to their defaults.
  3. Absence of Third-Party Antivirus: Windows is designed to always have an active antivirus. If you disable Defender but do not install an alternative like Bitdefender, Norton, or Kaspersky, the "Windows Security Center" service will eventually detect the vacuum and attempt to restart Defender to protect the system.

A Better Alternative: Adding Exclusions

If your primary reason for disabling Defender is because it interferes with specific software, development folders, or games, you don't actually need to turn off the entire system. You can use the "Exclusions" feature, which tells Defender to ignore specific files, folders, or processes.

How to Add an Exclusion

  1. Go to Windows Security > Virus & threat protection > Manage settings.
  2. Scroll to the bottom and click Add or remove exclusions.
  3. Click Add an exclusion and choose whether you want to exclude a specific File, Folder, File type, or Process.
  4. In our testing, excluding a high-level folder (like C:\Dev or D:\Games) significantly improves performance without leaving the rest of the system (like your browser and downloads) exposed to threats.

This is the "pro-level" approach. It keeps your system's perimeter secure while allowing your trusted applications to run without the overhead of constant heuristic scanning.

Conclusion

Turning off Windows Defender in 2025 is no longer a simple one-click affair. Microsoft has built multiple redundant layers—Tamper Protection, Group Policy, and the Windows Security Center service—to ensure that the OS remains protected. For temporary needs, the Settings toggle is sufficient. For permanent changes, Pro users should look to Group Policy, while Home users must navigate the Registry Editor, always keeping in mind that Tamper Protection must be disabled first.

While the methods described here are technically effective, we advise that you only run a system without Defender if you have a high-quality third-party security suite or if the machine is entirely isolated from the internet.

Summary Table of Methods

Method Permanence Best For Requirement
Settings Toggle Temporary Quick tasks, installing trusted software User Admin Rights
Group Policy Permanent IT Pros, Workstations (Pro/Ent) Tamper Protection Off
Registry Editor Permanent Home Edition users Tamper Protection Off
PowerShell Semi-Permanent Automation, Scripting Admin Terminal
Exclusions Targeted Developers, Gamers Specific File Paths

FAQ

Q: Does disabling Windows Defender make my computer faster? A: On modern hardware (SSD, 16GB+ RAM), the performance gain is negligible (usually less than 1-2% CPU usage). However, on older systems or during heavy file-indexing tasks, you may notice a more significant improvement in responsiveness.

Q: Can I just uninstall Windows Defender? A: No. Windows Defender is not a standalone "app" in the traditional sense; it is a core component of the Windows image. You cannot uninstall it via the Control Panel. You can only disable its services.

Q: Is it safe to browse the web with Defender off? A: It is highly risky. Most modern malware is delivered via browser exploits or "drive-by" downloads. If you must disable it, we recommend using a hardened browser and avoiding any untrusted sites.

Q: Will installing another antivirus turn it off automatically? A: Yes. In almost all cases, Windows is designed to detect a third-party antivirus (like Avast or McAfee) and automatically put Windows Defender into "Passive Mode" or disable it entirely to prevent system conflicts. This is actually the "official" way to disable it.