How to Disable Windows Defender (And What You Should Know First)

Windows Defender — officially called Microsoft Defender Antivirus — is built into Windows 10 and Windows 11 as the default real-time protection layer. Disabling it is straightforward in some situations and surprisingly persistent in others, depending on your Windows version, your account type, and whether your system has third-party security software installed.

Before walking through the methods, it's worth understanding why Defender behaves the way it does — because that context changes which approach actually works for your setup.

Why Windows Defender Doesn't Always Stay Off

Microsoft designed Defender to re-enable itself under certain conditions. If no other recognized antivirus program is active, Windows will turn Defender back on automatically. This is intentional — the system is trying to ensure there's never a gap in protection.

This means a temporary disable and a permanent disable are two very different operations, and the right one depends entirely on what you're trying to accomplish.

Method 1: Temporarily Turn Off Real-Time Protection

This is the most common need — pausing Defender briefly to install software it's blocking, run a specific tool, or troubleshoot a conflict.

Steps (Windows 10 and 11):

1. Open Windows Security (search for it in the Start menu)
2. Click Virus & threat protection
3. Under Virus & threat protection settings, click Manage settings
4. Toggle Real-time protection to Off

⚠️ Defender will re-enable itself automatically after a period of inactivity or after a reboot. This is by design and cannot be changed through this interface alone.

Method 2: Disable Defender via Group Policy (Windows Pro and Enterprise)

If you're running Windows 10 Pro, Windows 11 Pro, or any Enterprise edition, the Local Group Policy Editor gives you a more durable off switch.

Steps:

1. Press Win + R, type gpedit.msc, and hit Enter
2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus
3. Double-click Turn off Microsoft Defender Antivirus
4. Select Enabled and click OK
5. Restart your PC

Note: Windows Home editions do not include Group Policy Editor. This method won't work on Home without third-party tools or workarounds.

Method 3: Use the Registry Editor (All Editions, Including Home)

The Registry approach works across more Windows versions but carries more risk if done incorrectly.

Steps:

1. Open Registry Editor (Win + R → regedit)
2. Navigate to: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender
3. Right-click the right pane → New → DWORD (32-bit) Value
4. Name it DisableAntiSpyware
5. Set the value to 1
6. Restart

Important caveat: In Windows 11 and later builds of Windows 10, Tamper Protection must be disabled first (found in Windows Security → Virus & threat protection settings → Manage settings). If Tamper Protection is active, registry changes to Defender will be ignored or reversed.

Method 4: Let a Third-Party Antivirus Do It Automatically

If your goal is to replace Defender with another security product, this is often the cleanest path. When you install a recognized third-party antivirus (such as those from major security vendors), Windows will automatically detect it, register it with the Windows Security Center, and shift Defender into a passive or disabled state.

In passive mode, Defender no longer runs active scans but may still perform periodic checks in the background. Full disablement in this scenario depends on the third-party software's integration with Windows.

Key Variables That Affect Your Approach 🔍

What "Disabled" Actually Means in Practice

Even when Defender appears off, some components may still run. Windows Security (the dashboard app) remains active. SmartScreen, Firewall, and Device Security features are separate from Defender Antivirus and are not affected by the steps above.

If you're disabling Defender to run specific software, a temporary toggle is usually sufficient. If you're configuring a dedicated machine — a development environment, an air-gapped workstation, or a system running its own endpoint protection — the Group Policy or registry method gives more lasting results.

The Passive Mode Gray Zone

One nuance that catches many users off guard: Defender in passive mode is not the same as Defender being off. Passive mode means it's not your primary scanner, but it's still present and may log activity. For most users replacing Defender with another AV, passive mode is fine. For users who need Defender fully inactive — particularly in enterprise or developer scenarios — that distinction matters and may require the Group Policy approach on top of third-party AV installation.

How much any of this matters depends on the specific reason you're disabling Defender, the software or workflow involved, and the level of control your Windows edition actually allows.