How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

What is Microsoft Defender Antivirus?

Microsoft Defender Antivirus is the built-in security software for Windows 10 and Windows 11. It helps protect your computer from viruses, malware, and other threats.

What is Real-time Protection?

Microsoft Defender’s real-time protection is like a security guard for your PC. It constantly checks files you open or download for viruses and malware, stopping them before they can harm your computer. Turning it off means these checks won’t happen, leaving your system more vulnerable to online threats.

Turning off real-time protection for Microsoft Defender Antivirus in Windows 11 means files opened or downloaded will not be checked for threats. This action poses risks for most users and is not recommended.

Option 1Use Windows Security

The easiest way to manage Microsoft Defender’s real-time protection on Windows 11 is through the Windows Security app. This built-in tool lets you quickly switch real-time protection on or off with just a few clicks. Follow these simple steps to adjust the setting to your needs.

1. Open Windows Security.
2. Click Virus & threat protection.
3. Click the Manage settings link under Virus & threat protection settings.
4. Turn Real-time protection On (default) or Off based on what you want.
5. 🔒 Admin required: If prompted by UAC, click Yes to approve.
6. Close Windows Security when done.

Turning off real-time protection for Microsoft Defender Antivirus in Windows 11 will cause the protection to turn back on automatically after a short time. To keep real-time protection off, users must first turn off Tamper Protection.

Option 2Use Command Line

For those comfortable with commands, you can control Microsoft Defender’s real-time protection using Windows Terminal. This advanced method requires turning off Tamper Protection first and then entering specific commands. Open Windows Terminal as an administrator and paste the correct command to enable or disable real-time protection.

Steps:

1. 🔒 Admin required: Open Windows Terminal as Administrator. Choose either Windows PowerShell or Command Prompt.
2. Copy and paste one of the commands below and press Enter.
3. Close Windows Terminal when done.

To Turn On Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 0

OR

Set-MpPreference -DisableRealtimeMonitoring $false

To Turn Off Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 1

OR

Set-MpPreference -DisableRealtimeMonitoring $true

Option 3Use Local Group Policy Editor

If you have Windows 11 Pro, Enterprise, or Education, you can manage Microsoft Defender’s real-time protection using the Local Group Policy Editor. Before you begin, make sure to disable Tamper Protection. This method allows for more granular control over security settings by navigating through specific policy paths.

Steps:

1. 🔒 Admin required: Open the Local Group Policy Editor by typing gpedit.msc in 🔍 the search box.
2. Navigate to this path on the left side:
   
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. On the right side, double-click the Turn off real-time protection policy.

To Enable Real-time Protection:

1. Select the dot next to Not Configured.
2. Click OK.
3. Close the Local Group Policy Editor.

To Disable Real-time Protection:

1. Select the dot next to Enabled.
2. Click OK.
3. Close the Local Group Policy Editor.

Option 4Edit the Registry

Editing the Windows Registry is another advanced option to change Microsoft Defender’s real-time protection settings. It’s crucial to disable Tamper Protection beforehand to make these changes. This method involves directly modifying system settings by entering specific commands in the Terminal.

Steps:

1. 🔒 Admin required: Open the Terminal app.
2. Copy and paste the command below and press Enter.

To Enable Real-time Protection:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

To Disable Real-time Protection:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Summary

Real-time protection is a vital security feature of Microsoft Defender that continuously scans for threats to keep your PC safe, and you can manage it through Windows Security, Command Line, Group Policy, or the Registry.