How to Disable Microsoft Defender in Windows 11: Step-by-Step Guide in 2026

Microsoft Defender is Windows 11’s built-in antivirus protection. While it provides solid security for most users, you might need to disable it temporarily for software testing, troubleshooting conflicts, or installing third-party security solutions. Here’s exactly how to turn it off, when you should do it, and what risks you’re taking.

Why You Might Need to Disable Windows Defender

Before we get into the steps, let’s be clear about valid reasons to disable Defender:

Legitimate scenarios:

• Installing alternative antivirus software that conflicts with Defender
• Testing software you’re developing without interference
• Troubleshooting system performance issues
• Running specialized security tools that need exclusive access
• Gaming on systems where every bit of performance matters

Bad reasons to disable it:

• A random website told you to
• You think it slows down your computer (it rarely does on modern systems)
• You want to run cracked software (don’t do this)

Windows Defender has improved dramatically since its early days. In 2026, it catches threats as effectively as most paid alternatives according to independent testing labs. Think twice before turning it off permanently.

Temporary vs Permanent Disabling

For temporary disabling (turns back on automatically after restart):

1. Open Windows Security
2. Go to Virus & threat protection
3. Click Manage settings under Virus & threat protection settings
4. Toggle Real-time protection to Off

For permanent disabling (requires more steps): You’ll need to use Group Policy Editor or Registry Editor. We’ll cover both methods below.

Method 1: Temporarily Disable Real-Time Protection

This is the simplest approach and works for most situations where you need Defender off for a few minutes or hours.

Step-by-step process:

1. Click the Start button and type “Windows Security”
2. Open the Windows Security app
3. Select “Virus & threat protection” from the left sidebar
4. Under “Virus & threat protection settings,” click “Manage settings”
5. Toggle “Real-time protection” to the Off position
6. Click Yes when User Account Control asks for permission

What happens now:

• Real-time scanning stops immediately
• Defender won’t scan files as you open them
• Protection automatically re-enables after you restart your computer
• You’ll see warning notifications in Windows Security

This method is perfect for installing a single program that Defender incorrectly flags or running a one-time scan with another tool.

Method 2: Disable Through Group Policy Editor (Windows 11 Pro, Enterprise, Education)

Group Policy Editor gives you more control and can make the change permanent. This method only works on Windows 11 Pro, Enterprise, or Education editions. Home edition users need to skip to Method 3.

Here’s how to do it:

1. Press Windows + R to open Run dialog
2. Type gpedit.msc and press Enter
3. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus
4. Double-click “Turn off Microsoft Defender Antivirus”
5. Select “Enabled” (yes, this is confusing, but “Enabled” means the policy to turn OFF Defender is enabled)
6. Click Apply, then OK
7. Restart your computer

To reverse this: Go back to the same policy and set it to “Not Configured” or “Disabled.”

Additional settings in Group Policy:

If you want to disable specific features instead of everything:

• Real-time protection only: Navigate to Real-time Protection subfolder and enable “Turn off real-time protection”
• Cloud-delivered protection: Go to MAPS subfolder and enable “Join Microsoft MAPS” set to Disabled
• Automatic sample submission: Under Reporting, enable “Configure Watson events”

Method 3: Disable via Registry Editor (All Windows 11 Editions)

Registry editing works on Windows 11 Home and gives the same result as Group Policy. Be careful here, incorrect registry changes can cause system problems.

Before you start: Back up your registry. Press Windows + R, type regedit, press Enter, then click File > Export and save a backup.

Registry modification steps:

1. Press Windows + R and type regedit
2. Click Yes on the User Account Control prompt
3. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
4. Right-click in the right pane and select New > DWORD (32-bit) Value
5. Name it DisableAntiSpyware
6. Double-click the new value and set it to 1
7. Click OK and close Registry Editor
8. Restart your computer

To re-enable Defender: Go back to the same registry key, double-click DisableAntiSpyware, and change the value to 0, or delete the entry entirely.

Method 4: Disable Tamper Protection First

In 2026, Windows 11 includes Tamper Protection, which prevents other programs and even some manual methods from disabling Defender. You need to turn this off before permanent changes work.

Turn off Tamper Protection:

1. Open Windows Security
2. Go to Virus & threat protection
3. Click Manage settings under Virus & threat protection settings
4. Scroll down to Tamper Protection
5. Toggle it to Off

Once this is off, the Group Policy or Registry methods will work properly.

Method 5: Using PowerShell Commands

For advanced users who prefer command-line control:

To disable real-time monitoring:

Set-MpPreference -DisableRealtimeMonitoring $true

Run PowerShell as Administrator, paste this command, and press Enter.

To disable specific features:

Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableBlockAtFirstSeen $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableScriptScanning $true

To re-enable everything:

Set-MpPreference -DisableRealtimeMonitoring $false

What Features Get Disabled

Understanding what you’re actually turning off helps you make informed decisions:

Feature	What It Does	Impact When Disabled
Real-time protection	Scans files as you access them	Files aren’t checked until manual scan
Cloud-delivered protection	Uses Microsoft’s cloud database for newest threats	Miss zero-day threat detection
Automatic sample submission	Sends suspicious files to Microsoft	No contribution to threat intelligence
Tamper Protection	Prevents malware from disabling Defender	Malware can turn off your protection
Controlled folder access	Blocks unauthorized changes to protected folders	Ransomware can encrypt your files
Network protection	Blocks connections to malicious websites	You can visit phishing sites without warning

Common Problems and Solutions

Defender turns back on automatically: This happens when you’ve only disabled real-time protection through Windows Security. Use Group Policy or Registry methods for permanent changes, and make sure Tamper Protection is off first.

Group Policy Editor not available: You’re running Windows 11 Home. Use the Registry Editor method instead or upgrade to Windows 11 Pro.

Changes don’t take effect: Restart your computer after making Group Policy or Registry changes. Also verify Tamper Protection is disabled.

Third-party antivirus didn’t disable Defender: Most reputable antivirus programs automatically disable Defender during installation. If yours didn’t, manually disable it using the methods above, then reinstall your antivirus software.

Getting “This app has been blocked by your administrator”: Your organization manages your device through enterprise policies. Contact your IT department. You won’t be able to override these restrictions without administrator credentials.

Risks You’re Taking

Let’s be brutally honest about what happens when Defender is off:

Immediate risks:

• No real-time scanning means malware can execute without detection
• Phishing links and malicious downloads aren’t blocked
• Ransomware can encrypt files without interference
• Browser exploits work without security layers stopping them

According to Microsoft’s 2025 security report, systems without active antivirus were 5.4 times more likely to experience malware infections compared to protected systems. That’s not marketing talk, that’s measured data from millions of devices.

If you must disable Defender:

• Install reputable alternative antivirus immediately
• Keep your system fully updated
• Don’t visit unfamiliar websites
• Don’t open email attachments from unknown senders
• Back up important files regularly

Best Practices for Safe Computing Without Defender

Running without Microsoft Defender requires extra caution:

Get quality alternative protection: If you’re disabling Defender to use another antivirus, choose established options like Bitdefender, Kaspersky, Norton, or ESET. Free antivirus often comes with bloatware and doesn’t provide comprehensive protection.

For more detailed comparisons, check AV-TEST’s latest antivirus evaluations which independently test security software performance.

Layer your security:

• Enable Windows Firewall even with Defender off
• Use a DNS-level blocker like Cloudflare’s 1.1.1.1 or Quad9
• Install browser extensions like uBlock Origin
• Keep Windows Update active for security patches

Practice safe habits:

• Download software only from official websites
• Verify file hashes for important downloads
• Run suspicious files in Windows Sandbox first
• Use standard user accounts for daily tasks, not administrator accounts

How to Re-Enable Microsoft Defender

Changed your mind? Here’s how to turn everything back on:

For temporary disabling method: Just restart your computer. Defender automatically re-enables.

For Group Policy method:

1. Open Group Policy Editor (Windows + R, type gpedit.msc)
2. Navigate to the same location as before
3. Set “Turn off Microsoft Defender Antivirus” to “Not Configured”
4. Restart your computer

For Registry method:

1. Open Registry Editor (Windows + R, type regedit)
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
3. Delete the DisableAntiSpyware value or set it to 0
4. Restart your computer

Re-enable Tamper Protection: Go to Windows Security > Virus & threat protection > Manage settings and toggle Tamper Protection back to On.

Verify Defender is working:

1. Open Windows Security
2. Check that all shields are green
3. Run a Quick scan to ensure scanning functions work
4. Visit the Microsoft malware test file page to verify real-time protection catches the harmless test file

Alternative: Exclusions Instead of Full Disable

Most situations don’t require completely disabling Defender. Add exclusions for specific files, folders, or processes instead:

How to add exclusions:

1. Open Windows Security
2. Go to Virus & threat protection
3. Click Manage settings under Virus & threat protection settings
4. Scroll to Exclusions and click “Add or remove exclusions”
5. Click “Add an exclusion” and choose:
   • File (for a specific executable or document)
   • Folder (for entire directories)
   • File type (for all files with an extension like .tmp)
   • Process (for running programs)

When to use exclusions:

• Development folders where you compile code
• Game directories with anti-cheat systems that conflict with Defender
• Virtual machine files that get scanned unnecessarily
• Specific legacy software that triggers false positives

This approach keeps you protected while solving the specific problem you’re facing.

Performance Impact Reality Check

Many people disable Defender thinking it slows down their computer. Let’s look at actual data:

2026 performance benchmarks:

• CPU usage during idle: Less than 1% on modern processors
• RAM usage: Approximately 150-200MB (trivial on systems with 8GB or more)
• Gaming performance impact: 0-2 FPS difference in independent tests
• Boot time addition: 1-3 seconds on SSD systems

When Defender actually impacts performance:

• During full system scans (schedule these during off-hours)
• On very old hardware (pre-2015 computers with mechanical hard drives)
• When scanning large file transfers or archives

For 99% of users on modern hardware, Defender’s performance impact is negligible. If your computer feels slow, the problem is likely elsewhere (startup programs, insufficient RAM, malware, or aging hardware).

Conclusion

Disabling Microsoft Defender in Windows 11 ranges from simple to technical depending on how permanent you need the change. For quick testing, toggle off real-time protection through Windows Security. For permanent changes, use Group Policy Editor on Pro editions or Registry Editor on Home editions. Always disable Tamper Protection first.

Key takeaways:

• Temporary disabling takes 30 seconds through Windows Security
• Permanent disabling requires Group Policy or Registry editing
• Tamper Protection must be off for permanent changes to stick
• Consider exclusions instead of complete disabling when possible
• Running without antivirus significantly increases infection risk
• Alternative antivirus should be installed before disabling Defender

Microsoft Defender has evolved into genuinely effective protection. In 2026, it catches threats as reliably as paid alternatives for most users. Only disable it when you have specific technical needs and understand the security implications. If you’re just trying to speed up your computer, look elsewhere because Defender probably isn’t your problem.