How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

What is Microsoft Defender Antivirus?

Microsoft Defender Antivirus is the built-in security software for Windows 10 and Windows 11. It helps protect your computer from viruses, malware, and other threats.

What is Real-time Protection?

Microsoft Defender’s real-time protection acts like a security guard for your PC, constantly watching for viruses and malware. This feature checks files you open or download and stops threats before they can cause harm. Turning off real-time protection leaves your computer open to online dangers.

When you turn off real-time protection in Windows 11, your PC won’t check files you open or download for threats. This action poses risks for most users and is not recommended.

Option 1Use Windows Security

You can turn Microsoft Defender’s real-time protection on or off in Windows 11 using the built-in Windows Security app. This tool lets you quickly adjust the setting with just a few clicks. Follow these steps to manage your antivirus protection.

1. Open Windows Security.
2. Click Virus & threat protection.
3. Click the Manage settings link under Virus & threat protection settings.
4. Turn Real-time protection On (default) or Off based on what you want.
5. 🔒 Admin required: If prompted by UAC, click Yes to approve.
6. Close Windows Security when done.

Turning off real-time protection for Microsoft Defender Antivirus in Windows 11 will cause the protection to turn back on automatically after a short time. To keep real-time protection off, users must first turn off Tamper Protection.

Option 2Use Command Line

If you’re comfortable using commands, you can disable or enable Microsoft Defender’s real-time protection through Windows Terminal. This method requires turning off Tamper Protection first. Open Windows Terminal as an administrator and use specific commands to manage this setting.

Steps:

1. 🔒 Admin required: Open Windows Terminal as Administrator. Choose either Windows PowerShell or Command Prompt.
2. Copy and paste one of the commands below and press Enter.
3. Close Windows Terminal when done.

To Turn On Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 0

OR

Set-MpPreference -DisableRealtimeMonitoring $false

To Turn Off Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 1

OR

Set-MpPreference -DisableRealtimeMonitoring $true

Option 3Use Local Group Policy Editor

For Windows 11 Pro, Enterprise, or Education users, the Local Group Policy Editor offers a way to manage Microsoft Defender’s real-time protection. You must disable Tamper Protection before using this method. This tool lets you control security settings through specific policy paths.

Steps:

1. 🔒 Admin required: Open the Local Group Policy Editor by typing gpedit.msc in 🔍 the search box.
2. Navigate to this path on the left side:
   
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. On the right side, double-click the Turn off real-time protection policy.

To Enable Real-time Protection:

1. Select the dot next to Not Configured.
2. Click OK.
3. Close the Local Group Policy Editor.

To Disable Real-time Protection:

1. Select the dot next to Enabled.
2. Click OK.
3. Close the Local Group Policy Editor.

Option 4Edit the Registry

Editing the Windows Registry is an advanced method to change Microsoft Defender’s real-time protection settings. It’s very important to disable Tamper Protection first. This method involves directly modifying system settings, so proceed with caution.

Steps:

1. 🔒 Admin required: Open the Terminal app.
2. Copy and paste the command below and press Enter.

To Enable Real-time Protection:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

To Disable Real-time Protection:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Summary

Real-time protection is a vital security feature of Microsoft Defender that continuously scans for threats to keep your PC safe, and you can manage it through Windows Security, Command Line, Group Policy, or the Registry.