How to Disable Windows Defender in Windows 11

Windows Defender — officially called Microsoft Defender Antivirus — is built directly into Windows 11 and runs automatically in the background. Most users never need to touch it. But there are legitimate reasons to disable it temporarily or long-term: testing software, running a legacy application, or switching to a third-party security suite that conflicts with Defender's real-time protection.

Before walking through the methods, it's worth understanding what you're actually changing — because "disabling Windows Defender" means different things depending on what you do.

What Windows Defender Actually Does

Microsoft Defender Antivirus operates through several layers:

• Real-time protection — actively scans files as they're opened, downloaded, or executed
• Cloud-delivered protection — sends suspicious file data to Microsoft's servers for analysis
• Automatic sample submission — shares flagged files with Microsoft
• Tamper protection — prevents unauthorized changes to Defender's settings

Turning off one layer doesn't disable the others. This distinction matters when you're troubleshooting or setting up a dual-security environment.

Method 1: Disable Real-Time Protection Temporarily (Windows Security App)

This is the simplest method and is designed to be reversible. Windows 11 will automatically re-enable real-time protection after a short period or after a restart.

1. Open Windows Security (search for it in the Start menu)
2. Select Virus & threat protection
3. Under Virus & threat protection settings, click Manage settings
4. Toggle Real-time protection to Off

This is the right approach for short tasks — installing a specific program, running a scan with another tool, or temporarily reducing system overhead during intensive workloads. It's not permanent.

Method 2: Disable Defender via Group Policy (Windows 11 Pro and Enterprise Only)

The Local Group Policy Editor is available on Pro, Education, and Enterprise editions of Windows 11 — not Home. This method gives more persistent control.

1. Press Win + R, type gpedit.msc, and hit Enter
2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus
3. Double-click Turn off Microsoft Defender Antivirus
4. Set it to Enabled and click OK

⚠️ Despite the confusing naming, setting this policy to "Enabled" turns Defender off. This is a common point of confusion.

Keep in mind: Tamper Protection must be disabled first (via Windows Security → Virus & threat protection settings) or Group Policy changes may be blocked or reversed.

Method 3: Disable via Registry Editor (All Editions)

For Windows 11 Home users without Group Policy access, the Registry Editor offers a similar result — but carries more risk if done incorrectly.

1. First, disable Tamper Protection in Windows Security settings
2. Press Win + R, type regedit, and hit Enter
3. Navigate to: HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender
4. Create a new DWORD (32-bit) Value named DisableAntiSpyware
5. Set its value to 1

This approach persists across reboots. To reverse it, delete the value or set it back to 0.

The registry method requires care. Editing the wrong key can cause unrelated system issues. Always back up the registry before making changes: File → Export within Registry Editor.

Method 4: Installing a Third-Party Antivirus

This is the path most users end up on without realizing it. When you install a recognized third-party antivirus — such as any major security suite — Windows 11 automatically detects it and puts Microsoft Defender into a passive mode. Defender steps back; the third-party tool takes primary responsibility.

This behavior is by design. For most users replacing Defender with another product, no manual disabling is needed at all.

The Tamper Protection Variable

Tamper Protection is the most common reason Defender changes don't stick. It's designed to block exactly the kind of modifications described above — including registry edits and policy changes — when applied through automated or unauthorized means.

You must disable Tamper Protection manually through the Windows Security interface before Group Policy or registry methods will take effect. It can only be toggled by a human through the UI (not scripted remotely), which is the point.

What Doesn't Work Anymore 🔒

Several methods that worked on Windows 10 no longer function reliably in Windows 11:

• Disabling Defender services directly through Task Manager or Services.msc — Windows rebuilds them
• Using msconfig to block startup — Tamper Protection overrides this
• Renaming or deleting Defender executable files — system protections prevent it

Microsoft has progressively hardened Defender's ability to protect itself, so workarounds that circulate on older forums often fail silently on Windows 11.

Factors That Affect Which Method Works for You

The right approach depends on several things specific to your setup:

• Windows 11 edition — Home users can't access Group Policy Editor
• Whether Tamper Protection is on — affects whether registry or policy changes will hold
• Why you're disabling it — temporary testing vs. permanent replacement vs. performance tuning all point to different methods
• Whether you're running another security product — which changes how Defender behaves automatically
• Your comfort with the registry — editing it incorrectly creates real risks

Someone disabling Defender for a one-time software install needs a completely different approach than an IT administrator configuring a managed enterprise device. The method that's appropriate — and the risks that come with it — shift considerably based on those variables.