How to Disable Windows Defender

By /


Affiliate disclosure: This post includes Amazon affiliate links. If you buy something through these links, we may earn a small commission — without any extra cost to you.

You’re trying to install a trusted legacy application or run a system test, but Windows Defender keeps blocking it. This built-in antivirus is designed to protect your PC, yet there are valid scenarios where you need to disable Windows Defender temporarily or permanently.

This guide covers every reliable method to disable Windows Defender, from quick UI toggles to advanced Registry and PowerShell techniques. You will learn how to stop real-time protection, prevent automatic re-enabling, and safely restore security afterward. Before proceeding, remember that disabling Defender exposes your system to malware and ransomware. Only proceed when necessary, and always re-enable protection once your task is complete.

Disable Tamper Protection First

Windows Security Tamper Protection off toggle screenshot

Before any disable method works on Windows 10 (22H2 or later) or Windows 11, you must turn off Tamper Protection. This security feature blocks unauthorized changes and will automatically re-enable Defender even after Registry or Group Policy edits.

Turn Off Tamper Protection via Windows Security

  1. Press Win + S, type Windows Security, and open the app.
  2. Go to Virus & threat protection.
  3. Under “Virus & threat protection settings,” click Manage settings.
  4. Find Tamper Protection.
  5. Toggle it to Off.
  6. Confirm the User Account Control (UAC) prompt.

Note: If Tamper Protection is grayed out, your organization or third-party antivirus may be managing it. You need admin rights or must remove other security tools first.

Without this step, most disable methods will fail or revert at reboot.

Temporarily Disable Real-Time Protection

Use this method for quick, short-term disablement, such as installing a flagged but trusted file.

Toggle Off Real-Time Protection in Settings

  1. Open Settings (Win + I).
  2. Go to Privacy & security > Windows Security > Virus & threat protection.
  3. Click Manage settings under “Virus & threat protection settings.”
  4. Toggle Real-time protection to Off.
  • Effect: Stops live scanning immediately.
  • Persistence: Usually resets after 15 to 20 minutes or on reboot.
  • Best for: One-time installations or troubleshooting false positives.

Warning: Windows may auto-enable it again. Do not rely on this for long-term disable.

Use Group Policy Editor (Pro and Enterprise Only)

Group Policy Editor Microsoft Defender Antivirus disable policy path screenshot

This is the cleanest, most persistent method, but it only works on Windows 10 or 11 Pro, Enterprise, or Education editions.

Apply via Local Group Policy Editor

  1. Press Win + R, type gpedit.msc, and hit Enter.
  2. Navigate to:
    Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
  3. Double-click Turn off Microsoft Defender Antivirus.
  4. Select Enabled, then click Apply and OK.
  5. (Optional) Go to the Real-time Protection subfolder and enable Turn off real-time protection.
  6. Restart your PC.
  • Persistence: High. Survives reboots if Tamper Protection is off.
  • Limitation: Not available in Windows Home.

Pro Tip: If Group Policy changes do not stick, reboot into Safe Mode and reapply the changes.

Edit Registry for Full Disable (All Windows Versions)

Registry Editor Windows Defender DisableAntiSpyware DWORD value example

The Registry method works on every edition, including Windows Home. It is more technical but highly effective when done correctly.

Manual Registry Steps

  1. Press Win + R, type regedit, and press Enter.
  2. Navigate to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
    – If the Windows Defender key is missing, right-click Microsoft, select New > Key, and name it Windows Defender.
  3. Right-click in the right pane, select New > DWORD (32-bit) Value.
  4. Name it DisableAntiSpyware, double-click it, and set Value data to 1.
  5. Navigate to or create:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
  6. Create a new DWORD named DisableRealtimeMonitoring and set the value to 1.
  7. Restart your computer.

Use a .reg File for Faster Application

Create a text file, rename it to disable-defender.reg, and paste this content:

“`reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
“DisableAntiSpyware”=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
“DisableRealtimeMonitoring”=dword:00000001
“`

Double-click to run and confirm the prompt.

Caution: Incorrect registry edits can break Windows. Always back up the registry before editing.

Disable Windows Defender via PowerShell Commands

PowerShell offers granular control. Run commands in an Administrator PowerShell window (search PowerShell, right-click, and select Run as administrator).

Turn Off Core Scanning Features

powershell
Set-MpPreference -DisableRealtimeMonitoring $true

This stops live scanning. Add more flags for deeper disable:

powershell
Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -Force

Stop Defender Services from Starting

To prevent Defender from auto-starting, disable its services:

powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend" -Name Start -Value 4
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc" -Name Start -Value 4
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Sense" -Name Start -Value 4

Disable Core Drivers

These drivers load early in boot. Disabling them prevents deep-level protection:

powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdnisDrv" -Name Start -Value 4
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdfilter" -Name Start -Value 4
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wdboot" -Name Start -Value 4

Note: You may need to re-run Set-MpPreference after each boot unless services and drivers are also disabled.

Fix Defender Turning Back On Automatically

Safe Mode boot Windows msconfig disable safe boot screenshot

Even after disabling, Windows may re-enable Defender, especially after updates or reboots.

Boot into Safe Mode to Apply Changes

  1. Press Win + R, type msconfig, and hit Enter.
  2. Go to the Boot tab, check Safe boot, and select Minimal.
  3. Click OK and restart.
  4. Once in Safe Mode, apply Registry or Group Policy changes.
  5. Reboot normally and disable Safe Mode in msconfig.

Why it works: In Safe Mode, Defender services do not run, so changes are not blocked or reverted.

Offline Registry Editing (Last Resort)

If the OS actively blocks edits, edit the registry from another system or a Linux live USB.

  1. Boot from a Linux Live USB (such as Ubuntu).
  2. Mount the Windows drive (usually sda2 or sda3).
  3. Navigate to /mnt/[drive]/Windows/System32/config/.
  4. Use chntpw or a similar tool to load the SYSTEM hive.
  5. Navigate to \SYSTEM\CurrentControlSet\Services\WinDefend.
  6. Set the Start value to 4.
  7. Repeat for WdNisSvc, Sense, and driver services.
  8. Reboot into Windows.

Warning: This is advanced. Incorrect edits can make Windows unbootable.

Auto-Restart Script at Login

Create a shortcut to re-disable Defender on every boot:

  1. Right-click the desktop, select New > Shortcut.
  2. Location:
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  3. Click Next, name it (for example, “Disable Defender”).
  4. Right-click the shortcut, select Properties > Advanced, and check Run as administrator.
  5. Place the shortcut in the Startup folder:
    C:\Users\[YourName]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Risk: Microsoft may flag this script as malicious. Antivirus warnings are common.

When to Use Each Method

Running Legacy Software

Do not disable Defender. Instead, use Exclusions. Go to Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Add the folder or .exe path. This lets the app run safely while keeping your system protected.

Malware Analysis or Reverse Engineering

Use Safe Mode or Offline Registry Editing to fully disable Defender. Ensure the machine is air-gapped (no network). Re-enable protection immediately after analysis.

Performance Testing

Use Group Policy or PowerShell to disable real-time scanning. Re-enable as soon as testing ends.

Windows Home Users

Use Registry Editor or PowerShell, since Group Policy is not included. Disable Tamper Protection first.

Re-enable Windows Defender After Use

Registry restore Windows Defender Start value 2 after disable screenshot

After completing your task, restore protection immediately.

Reverse Registry Changes

  1. Open regedit.
  2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
  3. Delete the DisableAntiSpyware and DisableRealtimeMonitoring values.
  4. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.
  5. Set Start values back to 2 (Automatic) for:
    – WinDefend
    – WdNisSvc
    – Sense
    – WdnisDrv, wdfilter, wdboot

Re-enable via Group Policy

  1. Open gpedit.msc.
  2. Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
  3. Set Turn off Microsoft Defender Antivirus to Not Configured.
  4. Restart.

Turn On Tamper Protection Again

  1. Open Windows Security.
  2. Go to Virus & threat protection > Manage settings.
  3. Toggle Tamper Protection back to On.

Verify: Check that real-time protection is active and no warnings appear.

Frequently Asked Questions About Disabling Windows Defender

How do I disable Windows Defender in Windows 11?

Open Windows Security, go to Virus & threat protection, click Manage settings, and toggle Tamper Protection off first. Then toggle Real-time protection to Off. For permanent disable, use the Registry or Group Policy method.

Can I disable Windows Defender without admin rights?

No. All disable methods require administrator privileges. Without admin access, you can only add Exclusions for specific files or folders.

Why does Windows Defender keep turning back on?

Modern Windows versions include Tamper Protection and self-healing mechanisms that automatically re-enable Defender after reboots or updates. Disable Tamper Protection first, or apply changes in Safe Mode.

Is it safe to disable Windows Defender permanently?

No. Permanently disabling Defender leaves your system vulnerable to malware, ransomware, and network attacks. Use exclusions for trusted apps instead, and only disable Defender temporarily for specific tasks.

What is the difference between disabling real-time protection and full disable?

Disabling real-time protection stops immediate scanning but Defender remains active. Full disable (via Registry or Group Policy) stops all services and drivers, effectively shutting down Defender completely.

Will installing a third-party antivirus disable Windows Defender automatically?

Yes. When you install a recognized third-party antivirus, Windows automatically disables Defender real-time protection to avoid conflicts. This is often the safest alternative to manual disable.

Key Takeaways for Safely Disabling Windows Defender

  • Tamper Protection must be off for any disable method to persist on modern Windows.
  • Exclusions are safer than full disable for trusted apps.
  • Group Policy is the best option for Pro and Enterprise users.
  • Registry edits work on all versions but require caution and backups.
  • PowerShell gives fine-grained control, ideal for scripting and automation.
  • Safe Mode or offline editing bypasses stubborn reactivation mechanisms.
  • Always re-enable protection after completing your task.

Microsoft continuously strengthens Defender’s resilience. Future updates may block or override these methods. If you install a third-party antivirus, Windows Defender disables itself automatically, which is often the safest alternative. Use this knowledge responsibly. Your system’s security depends on it.

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top