How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

What is Microsoft Defender Antivirus?

Microsoft Defender Antivirus serves as the built-in security software for Windows 10 and Windows 11. Computers rely on this utility to block viruses, malware, and other threats.

What is Real-time Protection?

Microsoft Defender’s real-time protection acts like a security guard for the PC, constantly watching for viruses and malware. This feature inspects files during opening or downloading ⬇️, halting threats before they cause damage. Disabling real-time protection leaves the computer vulnerable to online dangers.

Disabling real-time protection stops Windows 11 from checking downloaded or opened files for threats. This action introduces security risks for most users and remains unrecommended.

Option 1Use Windows Security

The built-in Windows Security app provides a graphical way to toggle Microsoft Defender's real-time protection. This utility permits swift adjustments through a few mouse clicks. The following procedure guides the management of antivirus protection.

1. Open Windows Security.
2. Click Virus & threat protection.
3. Click the Manage settings link under Virus & threat protection settings.
4. Turn Real-time protection On (default) or Off based on what you want.
5. 🔒 Admin required: If prompted by UAC, click Yes to approve.
6. Close Windows Security when done.

Deactivating real-time protection for Microsoft Defender Antivirus in Windows 11 causes the feature to re-enable itself automatically after a brief period. Maintaining a disabled state requires disabling Tamper Protection (a security setting that prevents unauthorized apps from changing security settings) beforehand.

Option 2Use Command Line

Command-line interfaces allow users to enable or disable Microsoft Defender's real-time protection through Windows Terminal. Tamper Protection must be turned off prior to executing this method. Launching Windows Terminal with administrative rights allows specific commands to govern this setting.

Steps:

1. 🔒 Admin required: Open Windows Terminal as Administrator. Choose either Windows PowerShell or Command Prompt.
2. Copy and paste one of the commands below and press Enter.
3. Close Windows Terminal when done.

To Turn On Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 0

OR

Set-MpPreference -DisableRealtimeMonitoring $false

To Turn Off Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 1

OR

Set-MpPreference -DisableRealtimeMonitoring $true

Option 3Use Local Group Policy Editor

Windows 11 Pro, Enterprise, or Education editions include the Local Group Policy Editor (a Microsoft Management Console snap-in for configuring system policies), offering another avenue for managing Microsoft Defender's real-time protection. Tamper Protection must be disabled before applying this method. This tool governs security configurations via specific policy paths.

Steps:

1. 🔒 Admin required: Open the Local Group Policy Editor by typing gpedit.msc in the search box.
2. Navigate to this path on the left side:
   
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. On the right side, double-click the Turn off real-time protection policy.

To Enable Real-time Protection:

1. Select the dot next to Not Configured.
2. Click OK.
3. Close the Local Group Policy Editor.

To Disable Real-time Protection:

1. Select the dot next to Enabled.
2. Click OK.
3. Close the Local Group Policy Editor.

Option 4Edit the Registry

Modifying the Windows Registry (a hierarchical database storing low-level operating system and application settings) serves as an advanced method for altering Microsoft Defender's real-time protection settings. Disabling Tamper Protection remains a mandatory prerequisite. Direct manipulation of system settings requires careful execution.

Steps:

1. 🔒 Admin required: Open the Terminal app.
2. Copy and paste the command below and press Enter.

To Enable Real-time Protection:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

To Disable Real-time Protection:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Summary

Real-time protection functions as a vital security feature of Microsoft Defender that continuously scans for threats to keep PCs safe, and Windows Security, Command Line, Group Policy, or the Registry provide management capabilities for this feature.