How to Enable or Disable Real-Time Protection for Microsoft Defender Antivirus in Windows 11

What is Microsoft Defender Antivirus?

Microsoft Defender Antivirus is the built-in security software for Windows 10 and Windows 11. It is the part of Windows that blocks viruses, malware and other threats, and most PCs rely on it unless another antivirus program has replaced it.

What is Real-time Protection?

It inspects files as you open or download them, so malware is stopped before it can do damage. When you turn it off, Windows 11 stops checking those files, and the PC is exposed to online threats. For most people that is a bad trade, so I don’t recommend leaving it off. If you only need it off for a short task, such as installing 💿 a trusted program that Defender keeps blocking, turn it back on as soon as you are done.

Controlled Folder Access (a security feature that prevents unauthorized changes to important folders) also depends on real-time protection, so it stops working while real-time protection is off.

Note: If you install a third-party antivirus program, Microsoft Defender turns itself off automatically. Real-time protection stays off while the other antivirus runs, even if you enable periodic scanning (a supplementary scanning feature). If the toggle is missing or greyed out, check whether another security product is installed, or whether your organization manages the PC with policy.

Option 1Use Windows Security

The Windows Security app is the quickest method. It takes a few clicks and needs no commands. Follow these steps to turn real-time protection on or off.

1. Open Windows Security. You can type Windows Security in the Start menu search and select it. The Windows Security window opens.
2. Click Virus & threat protection. The page shows your current threats, scan options and protection settings.
3. Under Virus & threat protection settings, click the Manage settings link. The list of protection toggles appears.
4. Set Real-time protection to On (the default) or Off, whichever you want. The toggle changes right away, and the Off position shows a warning that your device may be vulnerable.
5. 🔒 Admin required: If User Account Control (UAC) prompts you, click Yes to approve. If you are signed in as a standard user, you will be asked for an administrator password.
6. Close Windows Security when you are done.

When you turn real-time protection off this way, Windows 11 switches it back on by itself after a short time. To keep it off, you must first turn off Tamper Protection (a security setting that prevents unauthorized apps from changing security settings). You will find it in the same Manage settings page in Windows Security. Turn Tamper Protection back on after you finish, because it is a useful safeguard on its own.

Option 2Use Command Line

You can also turn Microsoft Defender's real-time protection on or off from the command line in Windows Terminal. This is handy if you prefer typing, or if you need to script the change. Turn Tamper Protection off before you run these commands, or the change will not hold. Windows Terminal must be running with administrative rights for the commands to work.

Steps:

1. 🔒 Admin required: Open Windows Terminal as Administrator. Right-click the Start button and choose the Terminal (Admin) entry, or search for Terminal and select Run as administrator. Approve the UAC prompt if it appears. You can use either Windows PowerShell or Command Prompt.
2. Copy and paste one of the commands below and press Enter. If the command works, it usually returns to the prompt without any message. If you see an access denied error, the terminal is not elevated or Tamper Protection is still on.
3. Close Windows Terminal when you are done.

To Turn On Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 0

OR

Set-MpPreference -DisableRealtimeMonitoring $false

To Turn Off Real-time Protection:

Set-MpPreference -DisableRealtimeMonitoring 1

OR

Set-MpPreference -DisableRealtimeMonitoring $true

To check the result, open Windows Security › Virus & threat protection › Manage settings and look at the Real-time protection toggle.

Option 3Use Local Group Policy Editor

Windows 11 Pro, Enterprise and Education include the Local Group Policy Editor (a Microsoft Management Console snap-in for configuring system policies). It gives you another way to manage Microsoft Defender's real-time protection. Windows 11 Home does not include this tool, so Home users should use one of the other methods. Turn off Tamper Protection before you apply this method.

Steps:

1. 🔒 Admin required: Open the Local Group Policy Editor by typing gpedit.msc in the search box and selecting the result. The Local Group Policy Editor window opens.
2. In the left pane, navigate to this path:
   
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
   
   The policies for that folder are listed in the right pane.
3. On the right side, double-click the Turn off real-time protection policy. Its settings window opens.

This policy is worded as "turn off", so Enabled means real-time protection is off. Pick the option that matches what you want.

To Enable Real-time Protection:

1. Select the dot next to Not Configured. This removes the policy and returns real-time protection to its normal state.
2. Click OK. The window closes and the policy list shows the new state.
3. Close the Local Group Policy Editor.

To Disable Real-time Protection:

1. Select the dot next to Enabled.
2. Click OK. The window closes and the policy list shows the new state.
3. Close the Local Group Policy Editor.

To undo the change later, open the same policy and set it back to Not Configured.

Option 4Edit the Registry

The Windows Registry (a hierarchical database that stores low-level operating system and application settings) is an advanced way to change Microsoft Defender's real-time protection settings. Turn off Tamper Protection first, or the change will not stick. Be careful when you edit system settings directly, because a wrong entry can cause problems. Create a restore point before you start if you are not sure.

Steps:

1. 🔒 Admin required: Open the Terminal app as administrator. Approve the UAC prompt if it appears.
2. Copy and paste the command below that matches what you want, and press Enter. The command should finish and return to the prompt.

To Enable Real-time Protection:

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

To Disable Real-time Protection:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Check the result in Windows Security › Virus & threat protection › Manage settings If the toggle has not changed, confirm that Tamper Protection is off and sign out and back in, or restart the PC.

Summary

Real-time protection is a key security feature of Microsoft Defender. It scans for threats continuously to keep your PC safe. You can manage it through Windows Security, the command line, Group Policy or the Registry. For most people, the Windows Security app is the simplest choice, and the feature should stay on unless you have a specific reason to turn it off.