How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

What is Microsoft Defender Antivirus?

Microsoft Defender Antivirus is the built-in security software for Windows 10 and Windows 11. It helps protect your computer from viruses, malware, and other threats.

What is Real-time Protection?

Microsoft Defender’s real-time protection is a security feature that constantly watches your computer for viruses and other harmful software, stopping threats before they can cause damage.

Why turn it off? If you turn off real-time protection, files you open or download won’t be checked for threats. This is risky and not recommended for most users.

Important: You need admin rights to turn real-time protection on or off. Also, Controlled Folder Access requires real-time protection to be on.

Note: If you have another antivirus program installed, Microsoft Defender will turn itself off automatically. Real-time protection will stay off even if you enable periodic scanning while another antivirus is active.

Option 1Use Windows Security

You can easily turn Microsoft Defender’s real-time protection on or off using the Windows Security app, which is the simplest way for most people to manage this setting.

1. Open Windows Security.
2. Click Virus & threat protection.
3. Click the Manage settings link under Virus & threat protection settings.
4. Turn Real-time protection On (default) or Off based on what you want.
5. 🔒 Admin required: If prompted by UAC, click Yes to approve.
6. Close Windows Security when done.

Note: If you turn off real-time protection, it will turn back on automatically after a short time. Turn off Tamper Protection first if you want to keep it off.

Option 2Use Command Line

Advanced users can manage Microsoft Defender’s real-time protection using the Command Line or Windows PowerShell, but you must turn off Tamper Protection first.

Steps:

1. 🔒 Admin required: Open Windows Terminal as Administrator. Choose either Windows PowerShell or Command Prompt.
2. Copy and paste one of the commands below and press Enter.
3. Close Windows Terminal when done.

To Turn On Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 0

OR

Set-MpPreference -DisableRealtimeMonitoring $false

To Turn Off Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 1

OR

Set-MpPreference -DisableRealtimeMonitoring $true

Option 3Use Local Group Policy Editor

Windows 11 Pro, Enterprise, or Education users can control Microsoft Defender’s real-time protection settings with the Local Group Policy Editor, but you’ll need to disable Tamper Protection first.

Steps:

1. 🔒 Admin required: Open the Local Group Policy Editor by typing gpedit.msc in 🔍 the search box.
2. Navigate to this path on the left side:
   
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. On the right side, double-click the Turn off real-time protection policy.

To Enable Real-time Protection:

1. Select the dot next to Not Configured.
2. Click OK.
3. Close the Local Group Policy Editor.

To Disable Real-time Protection:

1. Select the dot next to Enabled.
2. Click OK.
3. Close the Local Group Policy Editor.

Option 4Edit the Registry

Editing the Windows Registry lets advanced users change Microsoft Defender’s real-time protection settings, but you must disable Tamper Protection before you start.

Steps:

1. 🔒 Admin required: Open the Terminal app.
2. Copy and paste the command below and press Enter.

To Enable Real-time Protection:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

To Disable Real-time Protection:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Summary

Real-time protection is a vital security feature of Microsoft Defender that continuously scans for threats to keep your PC safe, and you can manage it through Windows Security, Command Line, Group Policy, or the Registry.