How to Turn Off Windows Defender (And Why Not To)

Quick answer: Settings, Privacy and security, Windows Security, Virus and threat protection, Manage settings, then toggle Real-time protection off. That pause lasts until you reboot. A permanent shutdown needs Group Policy or a registry edit. Before you do either, read the exclusion section below, because roughly nine times out of ten an exclusion is what you actually wanted and it leaves the rest of the machine defended.

Twenty years in enterprise IT security has taught me that "how do I turn off the antivirus" is almost never the real question. It is the workaround someone reached for after the antivirus got in the way of something legitimate. So this guide gives you the honest instructions, and then the honest advice, which is usually not to.

The three ways to turn it off, in order of severity

1. Pause it (reverts on reboot)

This is the one most people want.

1. Open Settings, then Privacy and security, then Windows Security
2. Click Virus and threat protection
3. Under Virus and threat protection settings, click Manage settings
4. Toggle Real-time protection to Off

Windows will complain, and it will turn itself back on after a restart, and both of those behaviours are deliberate. Microsoft assumes that anyone pausing protection is doing it for a task, not forever.

Use this when you need ten minutes to install something Defender is blocking and you have already satisfied yourself that the file is genuinely safe.

2. Turn it off permanently with Group Policy (Pro and Enterprise)

If you are on Windows 11 Pro:

1. Press Win+R, type `gpedit.msc`, press Enter
2. Navigate to Computer Configuration, Administrative Templates, Windows Components, Microsoft Defender Antivirus
3. Open Turn off Microsoft Defender Antivirus and set it to Enabled
4. Reboot

Note the inverted wording. Setting a policy called "Turn off Microsoft Defender Antivirus" to Enabled is what disables the antivirus. That confuses people every single time.

You will also need Tamper Protection switched off first, under Virus and threat protection settings, or the policy will be ignored. Tamper Protection exists specifically because ransomware families spent years disabling Defender as their first move, and Microsoft got tired of it.

3. The registry edit (Home edition)

Windows 11 Home has no Group Policy editor, so the equivalent is a registry key under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender`. I am deliberately not writing a click-by-click registry walkthrough here, and that is not squeamishness. On current builds, Tamper Protection reverts most of these edits, a fair number of the guides circulating online are stale, and a mistyped key in that hive can leave you with a machine that boots to a black screen. If you are on Home and you genuinely need Defender gone, install the replacement antivirus instead and let Windows do the handover properly.

The case where you should do nothing at all

If you are turning Defender off in order to install a different antivirus, stop. There is nothing to do.

Windows detects a registered third-party antivirus and steps Defender down to passive mode automatically. It stops real-time scanning, it stops fighting the newcomer over file locks, and it keeps a limited periodic scan available as a second opinion. That handover is built in and has worked reliably since Windows 10.

People disable Defender manually first, install their new suite, and then wonder why the machine feels no different. It was never running two real-time scanners. Windows had already made the swap.

If you are choosing that replacement, our Microsoft Defender vs paid antivirus comparison covers the four user profiles where paying genuinely buys you something, and the larger number where it does not.

What you probably wanted instead: an exclusion

Here is the pattern I have seen for two decades. A developer compiles something and Defender quarantines the output. A gamer installs a mod loader and Defender eats it. Someone runs a legacy line-of-business tool and every launch takes forty seconds while the scanner inspects it.

None of those call for disabling protection on the whole machine. They call for an exclusion on one folder.

1. Settings, Privacy and security, Windows Security
2. Virus and threat protection, then Manage settings
3. Scroll to Exclusions, click Add or remove exclusions
4. Add an exclusion, then pick File, Folder, File type or Process

Exclude the narrowest thing that fixes the problem. One build output folder is a reasonable exclusion. The whole of `C:\` is not, and neither is your Downloads folder, which is precisely where hostile files land.

The important difference: with an exclusion, the rest of the machine stays defended. With Defender off, the browser you use for banking is running naked so that a compiler can finish four seconds sooner.

When turning it off is genuinely justified

I do not want to pretend this is never legitimate. Three real cases:

You are installing a security product that requires it. Some enterprise EDR agents want Defender fully out of the way rather than in passive mode. Follow the vendor's instructions, not a random guide.

You are running an isolated lab or malware analysis VM. If the machine exists to detonate samples, a scanner deleting them mid-analysis is not protection, it is an obstacle. That VM should be off the network and treated as disposable.

You are diagnosing a performance problem and need to prove Defender is the cause. Turn it off, measure, turn it back on. That is a test, not a configuration. If it turns out Defender genuinely is the bottleneck on an older machine, the fix is exclusions plus a scheduled scan window, and it is worth reading our PC optimization tools guide before you go buying more software to fix a problem that a scan schedule solves for free.

Notice that "it keeps nagging me" and "I am careful so I do not need it" are not on that list. The second one especially. Careful users get caught by supply-chain compromises in software they legitimately downloaded, and no amount of care inspects a signed installer that was tampered with upstream.

How to turn it back on

If the toggle is greyed out, or Windows Security shows the protection as managed by your organisation on a personal machine, something has set the policy and not cleaned up after itself.

1. Set the Group Policy above back to Not Configured, and reboot
2. Re-enable Tamper Protection under Virus and threat protection settings
3. If a third-party antivirus was uninstalled sloppily, run the vendor's removal tool. Half-removed security suites are the single most common reason Defender refuses to restart

Once it is running again, open Virus and threat protection and run a full scan rather than a quick one, because anything that arrived while protection was off has not been inspected.

The bottom line

The instructions are above because you asked for them and you own the machine. The advice is that the pause option covers almost every honest use case, the exclusion covers almost every remaining one, and the permanent shutdown is for lab machines and vendor requirements rather than for daily drivers.

If Defender is annoying you enough to want it gone, the more useful question is whether it is misfiring on something specific or whether you would rather run something else entirely. Those have different answers, and neither of them is an unprotected computer.

Frequently Asked Questions

Does turning off Windows Defender speed up my PC?

Occasionally, on older hardware with slow storage, and rarely by as much as people hope. Real-time scanning costs the most during heavy file operations such as compiling, extracting large archives or first-run game installs. If that is your bottleneck, a targeted folder exclusion recovers nearly all of the performance while leaving protection intact. On a machine with an SSD and 16GB of RAM, disabling Defender is not a performance strategy.

Will Windows turn Defender back on by itself?

Yes, if you only used the Real-time protection toggle. That is designed to revert on reboot so that a temporary pause cannot silently become a permanent hole. Only a Group Policy or registry change survives a restart, and Tamper Protection will fight even those unless you disable it first.

Is it safe to run no antivirus at all on Windows 11?

I would not, and I say that as someone who thinks Defender alone is sufficient for most people. Windows 11 is meaningfully hardened compared to Windows 7, but the current threat pattern is credential theft and info-stealers delivered through cracked software, malicious ads and fake installers, all of which are things a real-time scanner catches and a careful user sometimes does not.

Why is my Defender toggle greyed out?

Usually one of three things: a Group Policy is still applied, a third-party antivirus is registered and has taken over, or a previously uninstalled security suite left its registration behind. Work through those in order. The vendor's official removal tool solves the third case far more reliably than uninstalling through Settings.

Does disabling Defender remove it from Windows?

No. It stays installed and the Windows Security app remains, because it also handles the firewall, account protection and device security. You are switching off the antivirus engine, not uninstalling a component. That is also why re-enabling it is quick.