Turn Windows Defender Real-Time Protection On or Off (Windows 11/10)

To turn Windows Defender's real-time protection on or off in Windows 11 or Windows 10, open the Windows Security app. Go to Virus & threat protection. Click Manage settings. Flip the Real-time protection toggle. That's the whole answer if all you needed was the switch. But here's the part almost nobody tells you. On a fully updated PC, that toggle often doesn't stay where you leave it. Turn it off to install something Defender is wrongly flagging. Walk away for coffee. Come back, and it's back on. That's by design, not by accident.

This is one of the older questions on this site. We first answered it back when Windows 10 was brand new. Back then the setting lived one click away, in a Settings panel called "Update & security." Nine years and one full operating system later, the toggle still exists. But almost everything around it has changed. The app it lives in. What stops you from switching it. What actually happens when you try.

Turning real-time protection on or off in Windows 11

Windows 11 doesn't have a "Windows Defender" panel anymore. The antivirus engine is still called Microsoft Defender Antivirus. But the app you open to control it is Windows Security, and it's a separate program from the general Settings app. That distinction trips people up constantly. Old muscle memory says "go into Settings." In Windows 11, that only gets you halfway there.

Method 1: The Windows Security app (the one to use)

Use this method first. It works the same way on Windows 11 Home and Pro. It's also the one Microsoft actually supports and documents.

1) Press Win + S to open search. Type Windows Security and press Enter. (You can also reach it through Settings > Privacy & security > Windows Security > Open Windows Security. That's the "half" route most people stumble into first.)

2) Select Virus & threat protection from the left-hand menu. Or tap the shield icon on the home screen if the sidebar is collapsed.

3) Scroll to Virus & threat protection settings. Click Manage settings.

4) You'll see several toggles here: Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper Protection. Click the Real-time protection switch to flip it off or on.

Windows 11 will usually show a User Account Control prompt. Click Yes. If nothing happens when you click the toggle, or it flips back immediately, that's not this method failing. A different setting is overriding it. Skip ahead to the section on why it won't stay off.

Method 2: Group Policy Editor (Pro, Enterprise, Education only)

Skip this one on Windows 11 Home. gpedit.msc isn't installed on Home editions, full stop. On Pro, Enterprise, or Education, Group Policy gives the change more staying power against stray software resetting it. One honest caveat before you invest the effort: on a consumer PC, Tamper Protection overrides even Group Policy, so if the change needs to hold, turn Tamper Protection off first — the section below covers it.

1) Press Win + R to open the Run box. (The Run box is a small window that launches a program by its short internal name, instead of you hunting through menus.) Type gpedit.msc and press Enter.

2) Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection.

3) Double-click Turn off real-time protection. Set it to Enabled to disable real-time scanning. Set it to Not Configured or Disabled to leave real-time protection under normal control.

4) Click Apply, then OK. Restart, or run gpupdate /force from an elevated Command Prompt to push the change right away.

Read the policy name twice before you apply it. Enabling the policy called "Turn off real-time protection" is what turns real-time protection off. That double negative trips up even people who've used Group Policy for years.

Method 3: Registry Editor (works on Home, but has a ceiling)

Registry Editor is the Home-edition version of Group Policy. Same underlying setting, edited directly instead of through a friendly interface. Use this on Home if the Windows Security toggle won't hold.

1) Press Win + R. Type regedit and press Enter. Approve the UAC prompt.

2) Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection. If the "Real-Time Protection" key doesn't exist, right-click "Windows Defender," choose New > Key, and name it exactly that.

3) Inside that key, create a new DWORD (32-bit) value named DisableRealtimeMonitoring. Set it to 1 to turn real-time protection off. Set it to 0, or delete the value, to leave it under normal control.

4) Close Registry Editor. Restart the PC for the change to take effect.

Method 4: PowerShell (fastest for anyone comfortable with a command line)

Open PowerShell as administrator. Right-click the Start button and choose Terminal (Admin). Run this:

Set-MpPreference -DisableRealtimeMonitoring $true

To turn it back on, run the same command with $false instead of $true. This talks to the same Defender engine as the other three methods. So it hits the exact same Tamper Protection override. If Tamper Protection is on, the command will appear to succeed and change nothing.

Turning real-time protection on or off in Windows 10

Windows 10 also uses the Windows Security app. It replaced the standalone "Windows Defender" Settings page years ago — the one this post originally described, under "Update & security." The steps are the same on both Windows 11 and Windows 10 once you're inside the app: Virus & threat protection > Manage settings > toggle Real-time protection. Group Policy, Registry, and PowerShell work the same way too. Same edition split as well — Home gets Registry and PowerShell, Pro gets Group Policy on top.

Why the toggle is grayed out, or won't stay off

This section answers most people's real question. Most people who search for this aren't casually curious. They're stuck. Here's what each symptom actually means.

The toggle is gray and won't click at all

This almost always means one of two things. Either a third-party antivirus is installed and active. Or the device is managed by an organization.

Install a separate antivirus, free or paid, and Windows automatically stands Defender's real-time protection down. It hands the job to that program instead, and grays the toggle out. That stops two antivirus engines from running real-time scans against each other at once. This is intentional, correct behavior, not a bug. Uninstall the third-party antivirus completely, and Defender's real-time protection re-enables itself. That usually happens within a few minutes.

If the PC belongs to a workplace, a school, or a family member's managed Microsoft account, an administrator's policy is controlling the setting remotely. No amount of clicking, registry editing, or PowerShell will override that from the local machine. That's not a fixable "problem" on your end. It's the policy doing exactly what the administrator configured. If you genuinely need it changed, that request has to go through them.

You turn it off, and it turns itself back on

This is the modern version of exactly what this post described back in 2016. The honest update is that the cause has a name now: Tamper Protection. It sits in the same Windows Security > Manage settings screen, just below Real-time protection. When it's on, Windows blocks changes to core Defender settings from anything that isn't the Windows Security app's own trusted UI. That includes real-time protection. The point is to stop malware, a rogue script, or a cracked-software installer from quietly switching your antivirus off on your behalf.

Flip real-time protection off through the app itself while Tamper Protection is on, and the change usually holds for a few minutes to a few hours before it reverts. Flip it off through the registry or an unsigned script, and it can revert almost immediately. That's the exact pattern Tamper Protection is built to catch.

To make real-time protection actually stay off, turn Tamper Protection off first, from that same Manage settings screen. Then toggle Real-time protection separately. That's a bigger step than it looks. You're removing the safeguard that stops other software from disabling your antivirus without asking — not just this one setting.

Should you actually turn it off?

Almost never. Worth saying plainly: the most common reason people search for this is a false-positive block on something they're trying to install. And a good share of the time, that "false positive" is Defender correctly flagging pirated or cracked software packaged with something extra. Turning real-time protection off to get past that warning is popular advice in a lot of forum threads. It's bad advice. You'd be disabling the one thing standing between you and whatever the installer actually contains.

There are legitimate reasons to turn it off temporarily. Running a specialized security tool that conflicts with Defender's own scanning. Working with a large batch of files you already trust, for performance reasons. Troubleshooting whether Defender itself is causing a specific problem. In every case, the pattern should be the same: turn it off, do the specific task, turn it back on right after. Leaving real-time protection off as a standing state — especially while browsing or installing unfamiliar software — is exactly the scenario it exists to prevent.

What real-time protection is actually doing

Real-time protection is the part of Defender that watches files as they're opened, downloaded, copied, or run. It doesn't wait for a scheduled scan to check them later. Turning it off doesn't remove Defender, and it doesn't uninstall anything. It just stops that continuous watching. Scheduled and manual scans can still run while it's off. But they only catch what's already on disk at the moment you run them — not something being downloaded or executed while protection is disabled. That's the practical difference. On, Defender reacts the instant a threat touches the system. Off, it only knows what it finds the next time you ask it to look.

Multiple PCs, laptops, and remote setups

Everything above assumes you're sitting at the keyboard of the PC in question. A few situations change that.

Multiple PCs, like a shop full of them: Group Policy is the right tool if the machines are joined to a domain. One policy change applies everywhere at once. Outside a domain, script the PowerShell command instead. Push it through a basic remote-management tool, or just copy-paste it machine to machine. It's the fastest of the four methods when you're repeating the same change many times.

Laptops and tablets: nothing changes about the process on touch-only hardware. But Method 1, through the Windows Security app, is easier without a keyboard. It's all tap targets, not typed commands.

Remote Desktop sessions: all four methods work over Remote Desktop just like they would locally. One caveat: if Tamper Protection or a company policy is controlling the setting, being connected remotely with admin rights doesn't bypass either one. Both are evaluated against the device's own configuration, not the session type.

Virtual machines: a VM runs its own independent copy of Windows Security. Turning real-time protection off inside a VM has no effect on the host PC's protection, and vice versa. Treat each VM as its own separate machine.

Automating it for repeat situations

Do you toggle real-time protection off and back on for the same recurring task? Say, a nightly batch job that touches thousands of already-trusted files. Write a short PowerShell script that disables protection, runs the task, and re-enables protection in the same script. That removes the human step where someone forgets to turn it back on. Put the re-enable line inside a finally block if the script could fail partway through. That way protection comes back on even if the task errors out. This one habit — making the re-enable unconditional — matters more than any of the four toggle methods on its own. The real risk was never flipping the switch off. It was forgetting to flip it back.

Do you need a third-party antivirus on top of Defender?

This question comes up constantly alongside the on/off question. Worth answering honestly instead of dodging it. For most home users, on a current, patched version of Windows, Defender's real-time protection running continuously is a reasonable, complete answer on its own. It isn't the afterthought it was years ago. It's also the one antivirus guaranteed to be present, licensed, and updated automatically with the rest of Windows. Nothing extra to buy, renew, or forget to renew.

A third-party product earns its place with specific extras Defender doesn't try to do: a bundled VPN, dedicated identity-theft monitoring, parental controls with detailed reporting, or a password manager tied into the same subscription. Want one of those, and already paying for the suite? Fine to use that antivirus engine instead of Defender's real-time protection. Just don't run both continuously side by side. Two real-time engines watching the same files can slow the PC down, and can occasionally flag each other's activity as suspicious. That's exactly why Windows automatically stands Defender down the moment it detects another one installed.

Be skeptical of a "PC is infected, call this number" pop-up pushing an antivirus you've never heard of. That's a scam pattern, not a product recommendation. No legitimate antivirus vendor cold-calls you through a browser pop-up. See one? Close the browser tab. End the browser process from Task Manager if it won't close normally. Don't call the number. Don't download anything from the page.

Before you turn it off: a quick safety check

About to turn real-time protection off for a specific task? A few habits make the gap safer, not just shorter.

Disconnect from the internet while it's off, if the task allows it. Installing a local file from a USB drive doesn't need a network connection. Most real-world infections during an unprotected window arrive over the network — a drive-by download, a malicious ad, an email attachment fetched in the background. No connection removes that path entirely for the duration.

Know exactly what you're installing first. If a program's own installer is triggering the block, check that you downloaded it from the publisher's own site. Third-party download aggregators are a common place for legitimate software to get repackaged with something unwanted attached.

Run a full scan right after you turn protection back on. A full scan checks the entire drive, not just files touched since the last scan. That's exactly what you want after a window with no active real-time watching. From Virus & threat protection, choose Scan options, then Full scan.

Share this PC with anyone else? Family, coworkers, or customers if it's a shop machine. Turn protection back on before you hand it back. The next person has no way to know the setting was ever changed.

Write down when you turned it off. A sticky note works. So does a phone reminder set for later that day. The goal is simple: don't let "just for this one install" quietly turn into "off for a week." That gap is where real damage happens.

The adjacent task: checking what real-time protection has already caught

Settled the on/off question? The next thing most people want is to see what real-time protection has actually been doing in the background. Especially if you're trying to work out whether a specific file was blocked or quarantined. That history lives in the same app. Open Windows Security, go to Virus & threat protection, and look under Protection history. You'll find a timeline of everything Defender has flagged, allowed, or removed, including files it quarantined automatically. Trust a file that got caught there? Restore it from that same screen, and add it to Exclusions in the same motion. It won't get flagged again next time.

Protection history is also a good sanity check that protection has actually been working over time. Don't just trust the toggle's visual state — if Defender has been on the job, anything it ever blocked, quarantined, or allowed will be listed here, timestamped, which tells you more than a switch that merely looks green.

Frequently asked questions

What's the actual difference between Real-time protection and Tamper Protection?

Real-time protection is the scanning engine itself. It watches files as they're opened, downloaded, or run. Tamper Protection is a separate guard. It decides who's allowed to change settings like real-time protection in the first place. Turn Real-time protection off, and scanning stops. Turn Tamper Protection off, and nothing can block changes to the scanning settings anymore — including malware trying to make that same change for you. Two different switches, two different jobs. Confusing them is the most common reason real-time protection won't stay off.

Does real-time protection slow down gaming or other full-screen apps?

Windows Security detects full-screen apps and games automatically. It suppresses notifications and background scans while one is running, so day-to-day gameplay is generally unaffected. Chasing every last frame in a benchmark-sensitive game? Some players add an exclusion for the game's install folder instead of disabling real-time protection system-wide. That keeps the rest of the PC protected while removing scanning overhead for that one folder.

Does Windows tell me when real-time protection turns off?

Usually, yes. You'll see a notification, and the Windows Security icon in the taskbar gets a red warning badge. Open the app, and the home screen flags Virus & threat protection in red too. If you turned it off on purpose for a short task, that's expected and nothing to worry about. If you see that warning and you didn't turn anything off yourself, treat it as a real signal. Open Protection history and check what changed.

Can malware turn off real-time protection without me knowing?

That's the exact scenario Tamper Protection was built to stop. With Tamper Protection on, a script or a piece of malware can't quietly flip the setting off. Only the Windows Security app's own controls can do that, and those require a person clicking through them. With Tamper Protection off, that guardrail is gone. This is the strongest single reason to leave Tamper Protection on unless you have a specific reason to turn it off.

Is it safe to turn off real-time protection?

Briefly, for a specific task, yes — that's what the setting is for. Left off as a standing state, no. It removes the layer that catches threats the moment they touch the system. Most people who leave it off permanently don't have another real-time scanner running in its place.

Why does Windows Defender keep turning itself back on?

Almost always Tamper Protection. It blocks changes to core Defender settings from anything other than the Windows Security app's own controls. The goal is to stop malware from silently disabling protection. Turn Tamper Protection off first if you need the change to hold.

Why is the real-time protection toggle gray and unclickable?

Either a third-party antivirus is installed and running, so Windows has handed the job to that program. Or the device is managed by an organization, and a policy is controlling the setting remotely.

Does turning off real-time protection uninstall Windows Defender?

No. Defender stays installed. Manual or scheduled scans can still run while real-time protection is off. They just check whatever's already on disk at scan time, instead of watching continuously.

Can I turn off real-time protection permanently?

Yes, through Group Policy or the registry, and it'll hold as long as Tamper Protection is off too. Whether you should is a separate question. A PC with no active real-time scanning, no third-party replacement, and ongoing internet use is exactly the scenario the setting exists to prevent.

Does installing a third-party antivirus automatically disable Defender's real-time protection?

Yes, automatically and by design. Windows hands real-time scanning to the third-party program and grays out Defender's own toggle. That stops two real-time scanners from running against each other. Uninstall the third-party program, and Defender's real-time protection re-enables itself.

What's the difference between real-time protection and a full scan?

Real-time protection watches continuously, as files are opened, downloaded, or run. A full or quick scan is a one-time check of what's already stored on the drive at that moment. Turning real-time protection off doesn't affect your ability to run either kind of scan manually.

I turned it off through gpedit and it still won't stay off. Why?

Check Tamper Protection first, even though you used Group Policy. On a consumer PC, Tamper Protection can still override a Group Policy change, unless you've separately turned it off. On a domain-managed PC, check whether a higher-level administrator policy is re-applying the setting on a schedule.

Does Windows 11 handle this differently from Windows 10?

No. The app, the menu path, and the underlying settings are the same on both. The real difference: Windows 10 no longer gets free security patches without ESU enrollment. That makes real-time protection carry more weight on an unpatched Windows 10 PC than on a currently supported one.

Can I exclude a specific file or folder instead of turning protection off entirely?

Yes, and for a recurring false positive, that's the better fix. In Manage settings, scroll to "Exclusions" and add the specific file, folder, file type, or process. Real-time protection keeps running for everything else on the PC.

Will turning off real-time protection speed up my PC?

Sometimes, marginally, for specific heavy file operations — large batch copies or compiling code, for example. Those files aren't being scanned as they're touched. For general everyday use, most people won't notice a meaningful difference. It's not a fix worth the tradeoff for a generally slow PC.

My work or school laptop won't let me change this at all. What do I do?

Nothing on the device itself will change it. That's a deliberate choice by whoever manages the device, not a bug or a setting you're missing. Raise it with your IT department or administrator. There's no local workaround, and looking for one on a managed device isn't advisable.

Does Tamper Protection do anything besides protect real-time protection?

Yes. It protects several core Defender settings from being changed outside the Windows Security app, including cloud-delivered protection and the exclusions list, not just the real-time toggle. Turn Tamper Protection off, and you loosen all of them at once — not just the one you're focused on.

Revision note. Originally published December 19, 2016. Rewritten August 12, 2026 for Windows 11 and Windows 10. Back in 2016, the toggle lived under Settings > Update & security > Windows Defender. We could only tell you the setting "keeps turning on automatically," without a name for why. Microsoft has since moved the controls into the standalone Windows Security app, and given that behavior a name — Tamper Protection — with its own visible switch. If you landed here frustrated because a setting won't stay where you put it, you're not imagining things, and you're not doing anything wrong. Hang in there — the fix is a couple of clicks away.