How to Turn Off or On Microsoft Defender Antivirus Real-time Protection in Windows 11

Share

This post shows students and new users steps to enable or disable Microsoft Defender Antivirus Real-time Protections in Windows 11. Microsoft Defender Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.

By default, always-on (Real-time protection) is enabled and turned on in Windows 11. When enabled, the always-on feature monitors events such as file processes, file and registry changes, and other events on your devices for suspicious and known malicious activity.

Microsoft Defender’s Real-time antivirus protection will also scan downloaded files and attachments automatically. Disabling real-time protection drastically reduces the protection on your endpoints and is not recommended.

If you turn off Real-time protection, you will see a red alert in the Windows Security app under Real-time protection alerting you to re-enable always-on protection to keep your device secure.

How to enable or disable Microsoft Defender Real-time protection in Windows 11

As mentioned above, Microsoft Defender Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.

Below is how to turn On or Off Real-time protection in the Microsoft Defender Antivirus Windows Security app in Windows 11.

Change the Real-time protection setting:

In the search box on the taskbar, type Windows Security and then select Windows Security in the list of results.

In Windows Security, select Virus & threat protection.

Under Virus & threat protection settings, select Manage settings.

Change the Tamper Protection setting to On or Off.

How to enable or disable real-time protection in Group Policy

In Windows 11, open Local Group Policy Editor by clicking on the Start menu and searching for Edit group policy as highlighted below. Under Best match, select Edit group policy to launch Local Group Policy Editor.

In the left pane of Local Group Policy Editor, expand the tree: 

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection

In the Real-time Protection details pane on right, local and double-click the setting Turn off real-time protection.

In the Turn off real-time protection setting window, set the option to Enabled.

Select OK.

Close Local Group Policy Editor.

That should do it!

Conclusion:

This post showed you how to turn on or off Microsoft Defender Antivirus protection in Windows 11. If you find any error above or have something to add, please use the comment form below.