Windows Security

How to Turn Off Windows Defender — Temporary & Permanent (2026)

Published: April 16, 2026 10 min read IT Cares

Quick Answer

To temporarily turn off Windows Defender: go to Settings › Privacy & Security › Windows Security › Virus & threat protection › Manage settings › turn off Real-time protection. It re-enables automatically after reboot. For a permanent disable, you must first turn off Tamper Protection, then use Group Policy (Pro/Enterprise) or Registry Editor (all versions). Running without any antivirus is never recommended — see the alternatives section below.

Whether you are installing software that Windows Defender flags as a false positive, testing a development environment, or simply switching to a third-party antivirus, there are several valid reasons to turn off Windows Defender. The challenge is that Microsoft designed Defender to be persistent — it re-enables itself after every reboot unless you take the right steps.

This guide covers every working method in 2026, from the simple Settings toggle to advanced Group Policy and Registry edits. More importantly, it explains when it is safe to disable your antivirus — and when it absolutely is not.

2M+

Searches per month for this topic

30 sec

Fastest method (Settings toggle)

Methods covered in this guide

Before You Start: Understand Tamper Protection

The single biggest reason Windows Defender keeps turning itself back on is Tamper Protection. Introduced in Windows 10 version 1903 and enabled by default in all versions since, Tamper Protection blocks any external changes to Defender settings — including registry edits, scripts, and even third-party applications — unless those changes come from within the Windows Security interface itself.

    Important: If Tamper Protection is on, methods 3, 4, and 5 (Group Policy, Registry, PowerShell) will either be ignored or reversed at the next reboot. You must disable Tamper Protection first before those approaches will stick.
  

How to turn off Tamper Protection

Open Windows Security

Click the Start menu, search for Windows Security, and open it. Alternatively click the shield icon in your system tray.

Go to Virus & threat protection settings

Click Virus & threat protection, then under "Virus & threat protection settings" click Manage settings.

Toggle Tamper Protection off

Scroll down to Tamper Protection and set the toggle to Off. Confirm in the UAC (User Account Control) prompt that appears.

Once Tamper Protection is disabled, you can proceed to any of the five methods below without Windows silently reverting your changes.

Method Comparison — At a Glance

Method	Duration	Complexity	Windows Versions
1. Settings toggle (Real-time protection)	Temporary (reboot reverts)	Easy	All
2. Task Manager + Services	Current session only	Easy	All
3. Group Policy Editor (gpedit.msc)	Permanent	Intermediate	Pro / Enterprise only
4. Registry Editor (regedit)	Permanent	Intermediate	All
5. PowerShell (Set-MpPreference)	Until next update	Intermediate	All (admin required)

Method 1: Temporary Disable via Settings (Easiest)

Settings › Windows Security › Real-time Protection

Easy — All Versions

This is the official Microsoft method for briefly pausing Defender — for example, while installing software that triggers a false positive. Real-time protection will automatically turn back on after the next reboot, so this is suitable for short-term tasks only.

Press Windows + I to open Settings.
Go to Privacy & Security › Windows Security.
Click Open Windows Security.
Select Virus & threat protection.
Under "Virus & threat protection settings", click Manage settings.
Toggle Real-time protection to Off.
Click Yes in the UAC prompt.

Windows will display a notification that your device is at risk — this is expected. Real-time protection resumes automatically after a reboot or after approximately 15 minutes of inactivity, whichever comes first.

    Best use case: Installing a developer tool, game mod, or older software that Defender incorrectly flags. Complete the install, reboot, and Defender re-enables itself automatically with no further action needed.
  

Method 2: Temporary via Task Manager and Services

Stop the Windows Defender service via Task Manager

Easy — Current Session Only

Stopping the underlying Defender service suspends protection for the current Windows session. The service restarts automatically on the next reboot. This method is useful when the Settings toggle is greyed out due to IT policy.

Press Ctrl + Shift + Esc to open Task Manager.
Click the Services tab (or go to Services from the Start menu by searching services.msc).
Locate WinDefend (Windows Defender Antivirus Service).
Right-click it and select Stop.
Also locate Sense (Windows Defender Advanced Threat Protection) and stop it as well if present.

Note that on many systems with Tamper Protection active, you may receive an "Access Denied" error when attempting to stop these services. Disable Tamper Protection first as described at the beginning of this guide.

Method 3: Permanent Disable via Group Policy Editor

Group Policy Editor (gpedit.msc) — Windows Pro & Enterprise Only

Advanced — Pro/Enterprise Only

Group Policy is the most reliable way to permanently disable Windows Defender on Pro and Enterprise versions. This method survives Windows Updates and cannot be overridden by the standard Settings interface. Windows Home users do not have access to gpedit.msc and should use Method 4 instead.

Disable Tamper Protection first (see instructions at the top of this guide).
Press Windows + R, type gpedit.msc, and press Enter.
Navigate to: Computer Configuration › Administrative Templates › Windows Components › Microsoft Defender Antivirus.
Double-click "Turn off Microsoft Defender Antivirus".
Select Enabled and click Apply, then OK.
Reboot your computer for the policy to take effect.

After reboot, the Windows Security shield icon will show an alert. The Defender interface will indicate that it is managed by your organization. To re-enable Defender, return to the same policy setting and set it back to Not Configured.

    Windows Home users: If you type gpedit.msc and get "Windows cannot find gpedit.msc", your edition does not include Group Policy Editor. Skip to Method 4 (Registry) or Method 5 (PowerShell) instead.
  

Method 4: Permanent Disable via Registry Editor

Registry Editor (regedit) — Works on All Windows Versions

Advanced — All Versions

The registry method works on every version of Windows 10 and 11, including Home. It achieves the same result as Group Policy but through direct registry modification. Always create a registry backup before proceeding.

Disable Tamper Protection first (see instructions at the top of this guide).
Press Windows + R, type regedit, and press Enter.
Before making changes, go to File › Export and save a backup of the current registry.
Navigate to the following key (create it if it does not exist):

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

Right-click in the right pane, select New › DWORD (32-bit) Value.
Name it DisableAntiSpyware.
Double-click the new value and set it to 1. Click OK.
Reboot your computer.

To re-enable Windows Defender, return to the same registry location, double-click DisableAntiSpyware, and set the value back to 0 — or delete the DWORD entirely. Then re-enable Tamper Protection.

    Registry warning: Editing the Windows registry incorrectly can cause serious system instability. Only edit the exact key path shown above. Do not delete or modify other entries in the Windows Defender registry branch.
  

Method 5: Disable via PowerShell

PowerShell Set-MpPreference Command

Intermediate — All Versions

PowerShell provides fine-grained control over Defender components. You can disable real-time monitoring specifically without touching other protection layers. This method requires an elevated (Administrator) PowerShell window.

Disable Tamper Protection first.
Right-click the Start button and select Windows PowerShell (Admin) or Terminal (Admin).
To disable real-time monitoring:

Set-MpPreference -DisableRealtimeMonitoring $true

To disable additional protection components:

Set-MpPreference -DisableBehaviorMonitoring $true Set-MpPreference -DisableIOAVProtection $true Set-MpPreference -DisablePrivacyMode $true

To re-enable real-time monitoring:

Set-MpPreference -DisableRealtimeMonitoring $false

PowerShell changes may be partially reversed by Windows Update security patches. For a fully persistent disable, combine this method with the Group Policy or Registry approach above.

Safety Warning — When Is It Safe to Disable Windows Defender?

    Never run your PC without any antivirus protection. An unprotected Windows machine can be infected within minutes of connecting to the internet. Drive-by downloads, email attachments, and malicious ads are constantly active threats.
  

Safe scenarios for disabling Defender

Installing a third-party antivirus: When you install Bitdefender, Norton, or Malwarebytes Premium, Windows Defender disables itself automatically. You rarely need to disable it manually first.
False positive during software install: If Defender blocks a legitimate program, use Method 1 (temporary toggle) for the duration of the install only, then re-enable immediately.
Isolated development or testing environment: On a VM or air-gapped machine with no internet and no external media, the risk is substantially lower.
Software conflict diagnosis: Briefly disabling Defender helps determine whether it is causing performance issues or blocking specific application behaviour.

Unsafe scenarios — do not disable Defender unless you have a replacement

General everyday use on an internet-connected PC
Online banking, shopping, or accessing work accounts
Downloading files from unknown or untrusted sources
Shared or public computers

Best Antivirus Alternatives to Windows Defender

If the reason you want to disable Windows Defender is poor performance or limited features, consider switching to a dedicated antivirus that automatically takes over from Defender. These are the top-rated options in 2026:

Bitdefender Total Security

Top Rated 2026

Consistently ranked number one by independent labs (AV-Test, AV-Comparatives). Offers real-time protection, ransomware remediation, VPN, and parental controls with minimal impact on system performance. Automatically disables Windows Defender upon installation. Starting from approximately $45/year for 5 devices.

Malwarebytes Premium

Best for Malware Removal

Excellent at detecting and removing threats that other antivirus products miss — particularly adware, spyware, and potentially unwanted programs (PUPs). The free version only scans on demand; Premium adds real-time protection. Can run alongside Windows Defender for layered protection, or replace it entirely. Starting from approximately $40/year.

Norton 360 Standard

Full Security Suite

A comprehensive security suite with antivirus, dark web monitoring, password manager, VPN, and 10 GB of cloud backup included. Strong detection rates and a 100% virus protection promise (refund if not resolved). Best for users who want an all-in-one solution rather than a standalone antivirus. Starting from approximately $55/year.

Malware on your PC? We remove it remotely — from $59

IT Cares technicians handle antivirus setup, malware removal, and full security audits for Windows PCs. Remote session scheduled within 24 hours, 7 days a week, anywhere in Canada.

(888) 711-9428 Book a Remote Session

How to Re-enable Windows Defender

Regardless of which method you used to disable Defender, re-enabling it is straightforward:

Via Settings (reverses Method 1)

Go to Settings › Privacy & Security › Windows Security › Virus & threat protection › Manage settings and toggle Real-time protection back to On.

Via Group Policy (reverses Method 3)

Open gpedit.msc, navigate to the same path, double-click "Turn off Microsoft Defender Antivirus" and set it to Not Configured. Reboot.

Via Registry (reverses Method 4)

Open regedit, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender and either delete the DisableAntiSpyware DWORD or set its value to 0. Reboot.

Re-enable Tamper Protection

After Defender is back on, go to Virus & threat protection settings and toggle Tamper Protection back to On for maximum security going forward.

Frequently Asked Questions

Is it safe to turn off Windows Defender?

It is safe only if you are immediately replacing it with another reputable antivirus such as Bitdefender or Malwarebytes, or if you need to temporarily install specific software that triggers a false positive. Running a Windows PC with no antivirus protection is never recommended — modern malware can infect an unprotected system within minutes of connecting to the internet. Always have a replacement ready before disabling Defender permanently.

Does disabling Windows Defender speed up my PC?

Turning off real-time protection can free up a small amount of CPU and RAM, which may be noticeable on older or low-spec machines. However, the performance gain is generally minor on modern hardware. A better approach is to add exclusions for specific folders or applications inside Windows Security settings — this prevents Defender from scanning those locations while keeping full protection elsewhere. Go to Virus & threat protection › Manage settings › Add or remove exclusions.

How do I permanently disable Windows Defender?

To permanently disable Windows Defender, you must first turn off Tamper Protection (Settings › Windows Security › Virus & threat protection › Manage settings › Tamper Protection off). Then, on Windows Pro or Enterprise, use Group Policy Editor (gpedit.msc): Computer Configuration › Administrative Templates › Windows Components › Microsoft Defender Antivirus › "Turn off Microsoft Defender Antivirus" set to Enabled. On Windows Home, use Registry Editor: set DisableAntiSpyware to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. Reboot after either method.

What antivirus should I use instead of Windows Defender?

The best alternatives to Windows Defender in 2026 are Bitdefender Total Security (top-rated detection, minimal performance impact), Malwarebytes Premium (outstanding malware and spyware removal), Norton 360 (full security suite with VPN and dark web monitoring), and Kaspersky Standard (excellent detection rates). All of these automatically disable Windows Defender when installed, so you do not need to manually turn it off first. Not sure which is right for your setup? Call IT Cares at (888) 711-9428 for a recommendation.

How do I re-enable Windows Defender?

To re-enable Windows Defender: go to Settings › Privacy & Security › Windows Security › Virus & threat protection › Manage settings and toggle Real-time protection back on. If you disabled it via Group Policy, open gpedit.msc and set the "Turn off Microsoft Defender Antivirus" policy back to Not Configured. For registry edits, delete the DisableAntiSpyware DWORD value or set it to 0. Reboot after any of these changes, then re-enable Tamper Protection for full security.

Why does Windows Defender keep turning back on?

Windows Defender re-enables itself automatically after a reboot or Windows Update because Tamper Protection is on by default. Tamper Protection actively blocks any external changes to Defender settings. To prevent Defender from re-enabling, you must disable Tamper Protection first (through the Windows Security interface, not via registry or scripts), and then apply your chosen disable method. The Settings toggle alone is not persistent across reboots when Tamper Protection is active — use Group Policy or the Registry for a permanent change.