How to Activate Microsoft Defender Antivirus in Windows 11

Method 1Using the Local Group Policy Editor (🪟 Windows 11 Pro, Enterprise, Education)

The Local Group Policy Editor lets you manage Microsoft Defender Antivirus settings through a normal window. It is available in Windows 11 Pro, Enterprise and Education, and it gives you direct control over how the antivirus behaves.

This method does not work on Windows 11 Home. Home does not include the Local Group Policy Editor. If you run Home, skip to the Registry Editor method. To check your edition, go to Settings › System › About and look under Windows specifications.

Turn off Tamper Protection before you start. The steps for that are in the registry method further down. They are the same on every edition.

Step 1Open the Local Group Policy Editor

You open the editor from the Run box. Sign in with an administrator account first.

1. Press the Windows key and the R key together. The small Run window opens.
2. Type gpedit.msc into the box.
3. Press Enter or click OK. The Local Group Policy Editor opens.

If Windows says it cannot find the file, you are most likely on Windows 11 Home. Use the registry method instead.

Step 2Find the Microsoft Defender Settings

The folders you need are in the left pane. Open them in this order:

1. Click Computer Configuration.
2. Click Administrative Templates.
3. Click Windows Components.
4. Find and click Microsoft Defender Antivirus.

The list of Defender settings now appears in the right pane.

Step 3Find the "Turn off Microsoft Defender Antivirus" Setting

The setting you want is in the right pane of the Local Group Policy Editor window.

1. Scroll down the list until you find Turn off Microsoft Defender Antivirus.
2. Double-click Turn off Microsoft Defender Antivirus.

A configuration window opens with three options at the top left and a short description on the right.

Step 4Choose Whether to Enable or Disable

This window controls how Windows handles Defender. The wording is easy to mix up, because the policy is called "Turn off." Enabled means the "turn off" rule is active, so Defender is turned off. Disabled means the rule is not applied, so Defender keeps running. Not Configured lets Windows decide.

• Not Configured: This is the default. Windows decides what to do, usually turning off Defender if another antivirus is active.
• Enabled: If you choose this, you are telling Windows to turn off Microsoft Defender Antivirus.
• Disabled: If you choose this, you are telling Windows to keep Microsoft Defender Antivirus running.

To turn off Microsoft Defender Antivirus:

1. Select the circle next to Enabled.
2. Click Apply.
3. Click OK.

To turn on Microsoft Defender Antivirus (or make sure it's running):

1. Select the circle next to Not Configured or Disabled. Not Configured is usually the better choice because it lets Windows manage Defender and switch it off on its own if you install another antivirus.
2. Click Apply.
3. Click OK.

To undo your change at any time, come back to this window and set the policy to Not Configured.

Step 5Close the Editor and Restart Your PC

Restart your computer so Windows applies the new configuration properly.

1. Click the Start button.
2. Click Power.
3. Select Restart.

After the restart, open the Windows Security app to check that Defender is in the state you wanted.

Only do this if you have another strong antivirus program installed and running, or if you are doing temporary troubleshooting.

Method 2Using the Registry Editor (All 🪟 Windows 11 Editions)

The Registry Editor works on all Windows 11 editions, so this is the method to use if you run Home. The registry holds core Windows settings, and a wrong edit can cause problems. Back it up first: in the Registry Editor, click File › Export, choose a name and location, and save the file. If something goes wrong, double-click that file to restore the saved settings.

Step 1Turn Off Tamper Protection First!

You must turn off Tamper Protection before the registry change will work. This step is also needed before the Group Policy method.

1. Open the Windows Security app. The quickest way is to search for it in the Start menu.
2. Click Virus & threat protection.
3. Scroll down to Virus & threat protection settings and click Manage settings.
4. Scroll down again to Tamper Protection and switch it to Off.
5. Click Yes if a User Account Control (UAC) prompt appears.

The switch should now read Off. If it is greyed out, check that you are signed in as an administrator. On a work or school PC, your organization may manage this setting, and you will not be able to change it.

Step 2Open the Registry Editor

1. Press the Windows key and R together.
2. In the Run box, type regedit and press Enter.
3. Click Yes if a User Account Control prompt appears.

The Registry Editor opens, with a folder tree on the left and values on the right.

Step 3Go to the Correct Registry Location

Go to the Windows Defender policy location in the left pane: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. Expand each folder in turn until you reach it.

If the Windows Defender folder does not exist in that path, create it:

1. Right-click the Microsoft folder.
2. Select New.
3. Click Key.
4. Name the new key Windows Defender.

Click the new folder to select it. The right pane will be empty.

Step 4Create or Change the "DisableAntiSpyware" Setting

A DWORD (32-bit) value is a type of registry entry that holds a number. Creating one called DisableAntiSpyware in the Windows Defender folder is what tells Windows to turn off the built-in antivirus.

To turn off Microsoft Defender Antivirus:

1. Right-click the empty space in the right pane.
2. Choose New, then DWORD (32-bit) Value.
3. Name the new value exactly: DisableAntiSpyware.
4. Double-click the new DisableAntiSpyware value.
5. In the Value data box, type 1.
6. Click OK.

To turn on Microsoft Defender Antivirus (or make sure it's running):

1. If the DisableAntiSpyware value is there, double-click it.
2. Change Value data to 0.
3. Click OK.

If you created the DisableAntiSpyware value earlier only to turn off Defender, you can delete it instead:

1. Right-click DisableAntiSpyware.
2. Choose Delete.
3. Click Yes to confirm.

If you're not sure, setting it to 0 is a safe way to turn it back on.

Step 5Close the Registry Editor and Restart Your PC

Close the Registry Editor when you are done. As with the Group Policy method, you need to restart the computer for the change to take effect.

1. Click Start.
2. Click Power.
3. Select Restart.

If Defender still runs after the restart, Windows may be ignoring the setting because of its built-in protections. That is expected on recent builds and does not mean the registry change failed.

Step 6Turn Tamper Protection Back On (If You Turned It Off)

Once the PC has restarted and Defender is working the way you want, turn Tamper Protection back on. It guards your security settings against unwanted changes, and leaving it off keeps your PC more exposed.

1. Open Windows Security.
2. Go to Virus & threat protection › Manage settings.
3. Scroll down to Tamper Protection and switch it back to On.

Summary

You can manage Microsoft Defender Antivirus in Windows 11 with either the Local Group Policy Editor (Pro, Enterprise and Education) or the Registry Editor (all editions). Always turn off Tamper Protection first, restart your PC after making any change, and turn Tamper Protection back on when you finish. Think carefully about your computer's security before you turn off your antivirus, and make sure another protection program is running if you do.