How to Turn Off Windows Defender (Windows 11 & 10 Guide)
—
To turn off Windows Defender, open Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings, then switch off Real-time protection. That works the same way in Windows 11 and Windows 10. But here's the part almost nobody tells you: that toggle doesn't stay off. If your PC doesn't have another antivirus installed, Windows quietly turns Real-time protection back on within a short while — sometimes after a restart, sometimes sooner — because Microsoft has decided a Windows PC is not allowed to sit with zero antivirus running. If you actually need it off for good, that takes a different route entirely, and on some editions of Windows, it can't be done at all.
Jake had a customer drop off a laptop on a Saturday morning — a small accounting firm, three machines, all running a legacy invoicing tool that Windows Defender kept flagging as a threat and quarantining every time the machine rebooted. The software wasn't infected. It was just old, unsigned, and doing things that look exactly like what ransomware does on paper. The client wanted it gone. Jake wanted a five-minute fix. It took him most of the morning, because the first three things he tried didn't actually stick.
Turning It Off Temporarily in Windows 11
This is the version almost everyone actually needs — a few minutes of breathing room to install something Defender is blocking, run an old tool, or test something without real-time scanning getting in the way.
The steps
Open the Start menu and type Windows Security, or go to Settings > Privacy & security > Windows Security and click Open Windows Security. This app is the umbrella for everything Defender does now — virus scanning, firewall, device performance, family options — all under one roof instead of separate control panels.
Click Virus & threat protection in the left-hand list, then Manage settings under "Virus & threat protection settings." You'll see four toggles: Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper Protection. Switch off Real-time protection. Windows will ask you to confirm through a User Account Control prompt — that's the operating system double-checking a human, not a program, made the change.
♂️ Jake's Reality Check
"I flipped that switch, closed the app, and twenty minutes later it was back on by itself. Is Windows broken?"
No — that's Windows working as designed. Real-time protection re-enabling itself isn't a glitch; it's Microsoft refusing to leave a PC with no active antivirus at all. If you have no third-party antivirus installed, Defender is the only thing standing between that machine and the internet, so Windows treats the toggle as a short-lived pause, not a permanent decision.
The Windows 11 traps
Two things trip people up on newer Windows 11 builds specifically. First, the Windows Security app's left-hand navigation has been reorganized more than once, so if you're following an old screenshot and can't find "Virus & threat protection," the fastest route is the Start menu search box — type "virus" and the setting itself shows up as a direct result, no navigation required.
Second: if Tamper Protection is switched on — and it's on by default — the Real-time protection toggle may look and act normally, flip, hold for a bit, and revert anyway even faster than usual. Tamper Protection exists specifically to stop something other than you (including malware pretending to be you) from disabling Defender through Settings, the registry, or PowerShell. It doesn't block the manual toggle outright, but it's part of why "off" doesn't mean "off for good." More on that in a minute.
Making It Stick in Windows 11 Pro (Group Policy)
If you're on Windows 11 Pro, Enterprise, or Education, you have access to the Local Group Policy Editor — a tool that lets you set system-wide rules rather than flip individual switches that Windows can quietly reverse.
Press Win + R to open the Run box — a small command line that launches programs and system tools by name instead of hunting through menus — and type gpedit.msc. That's shorthand for "Group Policy Editor, Microsoft Console," and it opens a tree of every configurable system policy on the machine.
Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. Double-click Turn off Microsoft Defender Antivirus, set it to Enabled, and click OK. Restart the PC for it to take effect.
✅ Why this is the one to use if you're on Pro
A Group Policy setting is a rule the system enforces going forward, not a state it can silently revert on its own timer the way the Settings toggle does. It's the difference between telling Windows "off for now" and telling it "this is policy." If you have Pro and you genuinely need Defender off long-term — a dedicated VM host running its own hypervisor-level security, for instance — this is the honest way to do it, not a workaround.
⚠️ What this actually breaks
Even the Group Policy route can fail silently if Tamper Protection is still on — the policy will apply, but Defender can keep re-enabling itself anyway, and you won't get an error telling you why. Turn off Tamper Protection first, in Windows Security > Virus & threat protection > Manage settings, then set the policy, then restart. Skip that order and you'll spend an afternoon convinced Group Policy doesn't work, when really it's being overridden.
Windows 11 Home: The Registry Route
Windows 11 Home doesn't ship with the Local Group Policy Editor at all — that's a Pro-and-above feature, full stop, and there's no setting hiding in Home that turns it on. If you type gpedit.msc into the Run box on a Home machine, you'll get "Windows cannot find gpedit.msc." That's not you doing something wrong; it genuinely isn't there.
The Home equivalent is a direct registry edit. The registry is the master settings database Windows itself reads from — Group Policy is really just a friendlier front end for writing to the same place, so on Home you write to it by hand instead.
Press Win + R, type regedit, and confirm the prompt. Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
If the Windows Defender key doesn't exist under Policies, right-click Policies, choose New > Key, and name it Windows Defender. Inside it, right-click the empty space, choose New > DWORD (32-bit) Value, name it DisableAntiSpyware, and set its value to 1. Restart the PC.
⚠️ What this actually breaks
Be honest with yourself about this one: on current Windows 11 with Tamper Protection enabled, this key is frequently ignored outright, or gets deleted by Windows the next time Defender's own service starts. It's not a broken guide — it's Tamper Protection doing exactly what it's built to do, which is prevent registry edits from disabling protection behind the user's back. Turn off Tamper Protection in Windows Security first, and go in understanding that Microsoft may add further protections in a future update that make even that insufficient. If a permanent, policy-enforced disable actually matters for your setup, that's a real argument for Pro over Home.
The Three Methods, Side by Side
Before deciding which one to use, it helps to see all three next to each other rather than picking mid-scroll:
| Method | Works on Home? | Use it when |
|---|---|---|
| Settings toggle (Real-time protection) | Yes | You need a few minutes to install or run something Defender is blocking, and you'll turn it back on yourself when you're done. |
| Group Policy (gpedit.msc) | No — Pro/Enterprise/Education only | You need Defender off long-term, enforced by policy rather than a switch Windows can quietly flip back. |
| Registry (DisableAntiSpyware) | Yes | You're on Home and need it off longer than a session, accepting that Tamper Protection or a future update can still override it. |
Turning It Off in Windows 10
Good news if you jumped straight to this section: the temporary steps are identical to Windows 11 — Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings > toggle off Real-time protection (on Windows 10 it's filed under "Update & Security" rather than "Privacy & security," which is the one menu-path difference between the two versions). The Group Policy method (Pro) and the registry method (Home) are exactly the same keys and the exact same steps described above for Windows 11 — Microsoft didn't change the underlying policy or registry structure between the two versions, only where some settings live in the Settings app.
What changed since we first wrote this
- Then: back when we first covered Windows Defender on Windows 10, it was a standalone Windows Defender window with a simple on/off toggle and no separate "Windows Security" branding.
- Now: Microsoft folded that standalone app into the wider Windows Security app you see today, added Tamper Protection as a dedicated anti-tampering layer, and started automatically re-enabling protection on machines with no other antivirus installed.
- What that means for you: the toggle still exists in roughly the same place, but it no longer behaves like a simple permanent switch — it behaves like a pause, unless you back it with Group Policy or the registry and deal with Tamper Protection.
⚠️ The Windows 10 detail worth knowing
Windows 10 reached end of support on October 14, 2025. If this machine isn't enrolled in Extended Security Updates, it's still receiving Defender's own signature updates for now, but it is no longer getting the security patches for the rest of Windows — the operating system Defender is trying to protect. Disabling Defender on an unpatched, unsupported Windows 10 machine is a materially bigger risk than doing it on a currently-supported one. If that describes your PC, it's worth a five-minute look at whether it qualifies for the free or low-cost ESU enrollment before you go turning protection off.
Why Defender Keeps Turning Itself Back On
This is the single most-asked follow-up question, so it's worth pulling apart properly rather than waving at it. Three separate mechanisms can be responsible, and they're easy to confuse with each other:
1. No other antivirus is installed
Windows checks whether any registered antivirus is active on the machine. If Defender is the only one and you switch it off, Windows treats that as a gap rather than a decision, and restores it. This is the most common reason the Settings toggle "doesn't work" — it isn't failing, it's being deliberately overridden because nothing else is covering the machine.
2. Tamper Protection
Tamper Protection is a dedicated setting, separate from Real-time protection, whose entire job is to stop Defender's core settings from being changed by anything other than a direct, deliberate action in the Windows Security app itself — not the registry, not Group Policy, not a script. If it's on, it can undo registry edits and even some policy changes automatically. Turning it off first is a precondition for the other two methods to actually hold.
3. A managed device policy
If this is a work or school PC, or was ever enrolled in a mobile device management system, an administrator elsewhere may be pushing Defender settings that override anything you do locally. You'll usually see the giveaway line "Some settings are managed by your organization" inside Windows Security itself.
♂️ Jake's Reality Check
"So which one was actually stopping mine from staying off?"
Tamper Protection. It was Ethan who pointed out Jake had never touched it, and it defaults to on. Once he switched it off in Windows Security first, the Group Policy change he'd already made finally held.
When You Can't Turn It Off At All
"It's the worst position to discover you're in, and it's more common than people expect," is how Ethan put it to Jake — because there's no workaround, registry hack, or policy edit that fixes it. If your Windows 11 or 10 device is running in S mode, you cannot disable Windows Defender, full stop. S mode is a locked-down mode that only allows apps from the Microsoft Store and blocks changes to core security settings by design — it isn't a bug you can route around, it's the entire point of S mode. The only way past it is switching out of S mode entirely, which Microsoft allows (Settings > System > Activation, or Settings > Update & Security > Activation on Windows 10), but it's a one-way door: once you switch out of S mode, you can't switch back.
Beyond S mode, a machine controlled by a Microsoft Intune or Group Policy-based corporate policy simply won't let a local admin override it, by design, no matter which method above you try. If it's a work laptop, the honest answer is: that's not your call to make on that device.
Should You Actually Turn It Off?
Almost always, no — and that's not a hedge, it's the honest recommendation. Windows Defender is a real, capable antivirus that Microsoft has invested heavily in for years; it isn't the token afterthought it was in 2016. There is no need to stop it until it's actually causing a specific, identifiable problem.
There are a small number of legitimate reasons people actually land here:
- You're installing a third-party antivirus. You don't need to do anything manually — the moment you install a recognized third-party antivirus and register it properly, Windows automatically disables Defender's real-time scanning on its own, to avoid two antivirus engines fighting over the same files. If Defender is still active after installing one, the new antivirus likely isn't registering itself correctly, which is worth fixing before you touch any Defender setting yourself.
- A specific tool is being false-flagged, like Jake's invoicing software. The better fix here is usually an exclusion, not a full shutdown — Virus & threat protection > Manage settings > Add or remove exclusions, pointed at the specific file or folder. That solves the actual problem without leaving the rest of the machine unprotected.
- You're a developer or IT professional running your own security stack, in a sandboxed VM, or on a machine that never touches untrusted files or the open internet.
✅ Why exclusions beat disabling it, most of the time
An exclusion tells Defender to leave one specific file, folder, or process alone while still protecting everything else on the machine. Disabling Defender entirely protects nothing. For Jake's case — one flagged program, three machines that still browse the web and open email attachments — an exclusion on that program's folder solved it in two minutes and left the rest of each PC covered. That's the move we'd make first, before any of the steps above.
Common Failure Modes
The toggle is grayed out entirely, not just reverting. That's a different problem from the switch flipping back on its own. A grayed, unclickable toggle means an active policy is enforcing the setting right now — almost always the managed-organization scenario above. A switch that clicks, holds for a while, and then flips back on by itself later is Tamper Protection or the no-other-antivirus check, not a policy lock.
Group Policy changes don't survive a restart. Run gpupdate /force from an administrator Command Prompt after making the change, then restart. Occasionally the policy needs an explicit refresh to take before a reboot will actually apply it.
The registry key gets deleted on its own. That's Tamper Protection or Defender's own tamper-resistance service cleaning it up. Confirm Tamper Protection is actually off — not just unchecked in one place but reflected as off when you reopen Windows Security — before assuming the registry edit itself was wrong.
Everything looks off, but files still get scanned. Cloud-delivered protection and Automatic sample submission are separate toggles from Real-time protection. Turning off Real-time protection stops on-access scanning; it doesn't necessarily stop occasional cloud lookups unless that toggle is off too.
Frequently Asked Questions
Is it safe to turn off Windows Defender permanently?
Only if something else is actively protecting the machine — a properly registered third-party antivirus, or a controlled environment with no exposure to untrusted files or networks. Leaving a general-use PC with no antivirus at all is a real, not theoretical, risk.
Why does Windows turn Defender back on by itself?
Because it detects that no other antivirus is registered on the device, and treats an antivirus-free Windows PC as a state it shouldn't allow silently.
What is Tamper Protection and should I turn it off?
It's a setting that stops Defender's own protections from being changed by anything other than a direct action in the Windows Security app. Leave it on for normal use; only turn it off temporarily if you specifically need a Group Policy or registry change to actually hold, and consider turning it back on afterward.
Can I disable Windows Defender on Windows 11 Home?
Yes, through the registry, since Home doesn't include the Group Policy Editor. It's the same registry key used on Pro, but without policy enforcement behind it, so it's more likely to be reverted by Tamper Protection or a Windows update.
Why can't I find gpedit.msc on my PC?
The Local Group Policy Editor only ships with Windows Pro, Enterprise, and Education editions. It genuinely isn't present on Home — there's no hidden way to enable it built into the operating system itself.
Does installing another antivirus automatically disable Windows Defender?
Yes, if it's a recognized antivirus that registers itself properly with Windows. Defender's real-time scanning switches off on its own to avoid conflicts. You shouldn't need to disable Defender manually first.
Can I turn off Windows Defender in S mode?
No. S mode blocks changes to core security settings by design, and there's no workaround for it. The only path is switching the device out of S mode entirely, which is a one-way change.
Is there a way to turn off Defender for just one program instead of the whole PC?
Yes — add an exclusion for that specific file, folder, or process under Virus & threat protection > Manage settings > Add or remove exclusions. This is the recommended approach for false positives, since the rest of the machine stays protected.
Why does the toggle say "Some settings are managed by your organization"?
That means an administrator — through a workplace, school, or a mobile device management enrollment — is pushing Defender policy to the device, and it overrides local changes. On a personal device this shouldn't appear; if it does unexpectedly, it's worth checking whether the PC is enrolled in a management profile you don't recognize.
Do I need to disable Defender to install cracked or pirated software?
That's not something we can walk through here. If Defender is flagging software from an untrusted or unofficial source, the flag is very likely correct.
Does turning off Defender also turn off the Windows Firewall?
No. Firewall & network protection is a separate section inside the same Windows Security app, controlled independently from Virus & threat protection. Turning off Real-time protection has no effect on the firewall.
Is the process the same on Windows 10 and Windows 11?
The temporary Settings toggle, the Group Policy path, and the registry key are identical on both. The only difference is where Windows Security lives inside the Settings app — under Update & Security on Windows 10, and under Privacy & security on Windows 11.
Will Windows warn me if Defender is off with nothing else protecting the PC?
Yes — the Windows Security icon shows a red warning badge in the taskbar, and the app itself flags "Virus & threat protection" in red until either Defender is back on or another registered antivirus is detected.
Revision note. Originally published June 7, 2016. Rewritten August 14, 2026 for Windows 11 and Windows 10. Back in 2016, this was a simple standalone Windows Defender toggle; Microsoft has since folded it into the wider Windows Security app and added Tamper Protection to stop that toggle from being changed behind your back, which is exactly why the old one-click answer no longer holds up on its own. If you landed here frustrated that a setting you flipped off came right back on, that's not you doing anything wrong — hopefully the steps above finally get it to stick.