What Breaks When You Turn Off Network Protection in Microsoft Defender

What Does Network Protection Do in Microsoft Defender?

Network protection is a Microsoft Defender Antivirus feature that compares where an outgoing connection is going with Microsoft’s reputation data (a record of sites and addresses known or suspected to be harmful). If the destination is known or suspected to be harmful, Windows blocks the connection before any data loads. It works at the network level, so it applies to any app, not only a web browser.

It extends the reputation checks of Microsoft Defender SmartScreen (the service that warns you about dangerous sites and downloads in Edge) to the rest of the system. Without it, SmartScreen still protects Edge, but Chrome, Firefox, PowerShell, Office apps and other programs get no such check.

Network protection has three states: Disabled, Enabled (blocks harmful connections) and Audit mode (records what it would block but allows the connection). The sections below explain what each change means for your PC.

What Breaks When You Turn Off Network Protection?

Turning it off does not break an app or a Windows feature. What breaks is a layer of protection. The practical effects are below.

Browsers other than Edge lose reputation blocking

Edge keeps its own SmartScreen check. Chrome, Firefox, Brave and other browsers have their own built-in warnings, but they do not use Microsoft’s reputation data. With Network protection off, a site that Microsoft would block can load in those browsers.

Non-browser apps can reach dangerous destinations

Malware rarely uses a browser to download its next stage. A script, a document macro or an infected installer can call out to a bad domain directly. Network protection is the part of Defender that stops that outgoing call. Once you turn it off, nothing at the network level checks those connections against Microsoft’s reputation data.

Phishing and malware download sites stop being blocked

Phishing sites copy a login page to steal your password. Malware download sites host files that infect your PC. Network protection blocks both kinds of destination when Microsoft has flagged them. With the feature off, a link in an email, chat app or PDF can open the page without any Defender warning from this feature.

Command-and-control traffic is no longer blocked

Command-and-control servers are the machines attackers use to send instructions to an infected PC and collect stolen data. Network protection can cut that link when the server is known. If malware gets past your other defences, turning this feature off removes one chance to stop it from phoning home.

Defender for Endpoint features stop working

Two features in Microsoft Defender for Endpoint (Microsoft’s paid security service for organisations) depend on Network protection. Web content filtering, which blocks categories of sites such as adult content or file sharing, needs it. Custom indicators, the lists of URLs and IP addresses an administrator chooses to block, also rely on it.

If your PC is managed by an organisation, turning off Network protection disables those blocks on your device. Home users do not have these features.

What Keeps Working When Network Protection Is Off?

People often worry that this setting is tied to others. Other protections do not depend on Network protection. These protections stay in place:

• Real-time protection, which scans files as they open or download. See how to enable or disable Real-Time Protection for Microsoft Defender Antivirus.
• Cloud-delivered protection, which checks suspicious files against Microsoft’s online data. See how to enable or disable cloud-delivered protection.
• Microsoft Defender Firewall, which controls which apps may send and receive traffic. It filters by app, port and network profile, not by destination reputation. See how to turn on or off Microsoft Defender Firewall.
• SmartScreen in Microsoft Edge, which still warns you about dangerous sites in Edge.
• Scheduled and manual scans in Windows Security.

Turning off Network protection also does not speed up your internet connection or fix Windows Update. If you are changing it for those reasons, look elsewhere first.

Why Do People Turn Off Network Protection?

The usual reason is a false block. A legitimate site, a work tool or an internal server gets flagged, and the connection fails. The app may show a timeout or “can’t connect” error, and Windows Security may show a notification that a connection was blocked.

Before you turn the feature off for everything, try Audit mode. It keeps a record of what Network protection would have blocked without blocking it, and it tells you whether this feature is the cause. The steps are in the section How to Use Audit Mode Instead of Turning It Off.

How to Check Whether Network Protection Is On

Windows Security on Windows 11 does not have a Network protection switch. You check and change the setting with PowerShell (a command-line tool built into Windows). Group Policy or a device management service such as Intune (Microsoft’s cloud tool for managing company PCs) can also set it.

Group Policy (a tool for setting rules across a PC) is included in Pro, Enterprise and Education editions, but not Home. PowerShell works on every edition.

Checking the state changes nothing and usually does not need administrator rights. Use these steps.

1. Right-click Start and choose Terminal. A PowerShell window opens.
2. Type the command below and press Enter.
   

   ⬛PowerShell

   Copy

   Get-MpPreference | Select-Object EnableNetworkProtection

3. Read the number under EnableNetworkProtection. 0 means Disabled, 1 means Enabled and 2 means Audit mode.

If the value is already 0, Network protection is off and none of the effects above are new for your PC. If the command returns an error, make sure Microsoft Defender Antivirus is your active antivirus. A third-party antivirus can switch Defender into a passive state, and then its settings are not applied.

How to Turn Off Network Protection

This change requires administrator privileges. If your PC belongs to an organisation, an administrator may manage this setting, and your change may be blocked or reversed.

1. Click Start, type PowerShell, right-click Windows PowerShell and choose Run as administrator. Click Yes at the User Account Control prompt. A blue window titled Administrator: Windows PowerShell opens.
2. Type the command below and press Enter.
   

   ⬛PowerShell

   Copy

   Set-MpPreference -EnableNetworkProtection Disabled

   The command returns to a new prompt with no message. That is normal.

3. Run the check from the previous section again. EnableNetworkProtection should now show 0.

The change takes effect without a restart. If the value still shows 1 or 2, see the section on why the setting does not stay changed.

How to Use Audit Mode Instead of Turning It Off

Audit mode lets every connection through but writes an entry to the Windows event log each time Network protection would have blocked one. It suits a PC where a false block is suspected. You find out what is being flagged and keep the protection in place for later.

This change requires administrator privileges.

1. Open PowerShell as administrator, as described in the previous section.
2. Type the command below and press Enter.
   

   ⬛PowerShell

   Copy

   Set-MpPreference -EnableNetworkProtection AuditMode

3. Reproduce the problem. Open the site or run the tool that was failing. It should now connect.
4. Press Win+R, type eventvwr.msc and press Enter. Event Viewer opens.
5. In the left pane, go to Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational.
6. Click Filter Current Log in the right pane, type 1125 in the event ID box and click OK. The list now shows only audit entries.
7. Open an entry and read the General tab. It names the destination and the app that tried to reach it.

Event ID 1125 records an audit-mode event. Event ID 1126 records a connection that Network protection actually blocked while the feature was set to Enabled. If you see 1126 entries, Network protection is the cause of a failing connection and the entry names the destination.

If no 1125 entries appear and the problem continues, the failure is probably not caused by Network protection. Check your firewall, DNS, proxy or VPN instead.

Why the Setting Does Not Change or Comes Back

If EnableNetworkProtection returns to its old value, one of these is the usual cause.

• Policy from your organisation. Group Policy or Intune can set Network protection and reapply it at each policy refresh. Local PowerShell changes lose to that policy. Ask your IT team to change the policy, or accept the managed value.
• Tamper Protection. This Windows Security feature stops apps and scripts from changing some Defender settings. Microsoft’s documentation does not say whether Tamper Protection covers this setting. If your change keeps reverting, check Tamper Protection and policy together. The post on what breaks when you disable Windows Security Tamper Protection explains what you give up if you turn it off.
• Another antivirus is active. When a third-party antivirus is the main product, Defender runs in a limited state and its preferences may not apply.
• PowerShell was not opened as administrator. If the window title does not say Administrator, the command may fail with an access error. Close it and open it again with Run as administrator.

I am not giving a registry or Group Policy path for this setting. I have not verified one for this post, and a wrong value is worse than none. [Registry method: to be verified]

How to Turn Network Protection Back On

Reversing the change takes one command, and the protection applies at once with no restart.

This change requires administrator privileges.

1. Open PowerShell as administrator.
2. Type the command below and press Enter.
   

   ⬛PowerShell

   Copy

   Set-MpPreference -EnableNetworkProtection Enabled

3. Run Get-MpPreference | Select-Object EnableNetworkProtection. The value should show 1.

Make sure real-time protection and cloud-delivered protection are on as well. If you turned off cloud protection while troubleshooting, the post on how to turn on or off Microsoft Defender Antivirus cloud protection shows where the switch is in Windows Security.

Is It Safe to Leave Network Protection Off?

For a PC that stays off the internet, or one sitting behind strict filtering at a network or DNS level, the added risk is small. For a laptop that opens email, downloads files and uses several browsers, the risk is real. Phishing links and malicious downloads are the most common way infections start, and this feature is one of the few Defender layers that watches traffic from every app.

Leaving it off is a reasonable choice only if you have a reason and another control covers the gap. A good DNS filter (a service that blocks sites by their address name) or a managed web filter on your router can do part of the same job. Those tools do not see traffic once you leave that network, so a laptop away from home loses their protection.

A middle path works for most people. Keep Network protection on, use Audit mode to find the one site or tool that gets blocked, and deal with that case on its own. If the blocked site belongs to your organisation, ask the administrator to review it in Defender for Endpoint rather than disabling the feature for the whole PC.

What to Do Next

If you turned Network protection off to fix a blocked site, run Audit mode first and read the Event ID 1125 entries to see which destination was flagged. Then review your other Defender layers: PUA protection (short for potentially unwanted application protection) blocks unwanted bundled software, and core isolation protects Windows at the memory level. If you leave Network protection off, re-check the setting after major Windows feature updates and after any change by your IT team, since policy can switch it back on.