How to Disable Microsoft Defender in Windows

There is no supported way to permanently switch Microsoft Defender off on a personal Windows 11 or Windows 10 PC in 2026: the Windows Security toggle is deliberately temporary, and the old DisableAntiSpyware registry value has been ignored on client Windows since version 2004. Your real options are three — pause real-time protection for a single session, enforce a policy on a managed (domain-joined or Intune-managed) machine, or let a registered third-party antivirus push Defender into passive mode. If the underlying goal is smoother gaming rather than “no antivirus”, folder and process exclusions plus scan scheduling get you most of the benefit without leaving the PC exposed.

What you are actually turning off

Microsoft Defender Antivirus is the anti-malware engine built into Windows; it is not a separate app you can uninstall from the Programs list. It is really five features stacked together, and each one is controlled separately:

Microsoft 365 Administration Foundations: Manage Security and Threats Using Microsoft Defender XDR

Picked as a relevant option in this category.

View on Amazon →

Microsoft Defender XDR: A Hands-On Guide to Threat Intelligence, Advanced Hunting, Incident Investigation, Identity Protection, Endpoint Security, and Automated Response Across Microsoft Security

Chosen because it specifies Advanced Hunting and Incident Investigation.

View on Amazon →

Cyber Security Defense with Microsoft Defender

Picked as a relevant option in this category.

View on Amazon →

Microsoft Defender Field Guides: The Complete Collection: Four Volumes on Security Operations with Microsoft Defender for Endpoint, Defender XDR, Microsoft Sentinel, and KQL Threat Hunting

Chosen because it specifies Defender XDR and Microsoft Sentinel.

View on Amazon →

• Real-time protection — on-access scanning of every file as it is opened, written or executed. This is the part that touches game installs, patch downloads and shader caches.
• Cloud-delivered protection — reputation lookups sent to Microsoft when an unfamiliar executable runs.
• Behavior monitoring and network inspection — watches running processes and traffic for malicious patterns rather than file signatures.
• Tamper Protection — protects the settings above from being changed by anything other than the Windows Security UI or a management policy.
• Controlled Folder Access — optional ransomware protection for Documents, Pictures and similar folders; off by default.

That matters because “disabling Defender” in most guides means only the first item, and Windows re-arms it on its own.

The available methods and what each one changes

Exact registry and policy values

If you go the managed route, these are the values involved. All live under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and are DWORD type; the Group Policy editor simply writes them for you.

Temporary method: pause real-time protection for one session

Use this when you need to run something Defender is falsely flagging, or to check whether Defender is the cause of a stutter or a failed install. It takes under a minute and undoes itself.

1. Open Windows Security. Press Start, type “Windows Security”, and open it. Reason: the Settings app only links here; the actual toggles live in the Security app.
2. Go to Virus & threat protection → Manage settings. This page holds every user-controllable Defender switch.
3. Turn off Real-time protection. Reason: this is the setting that scans files as the game or launcher opens them — the only one with a measurable effect on installs, patching and shader compilation.
4. Optionally turn off Cloud-delivered protection and Automatic sample submission. Reason: these add a network round-trip the first time an unfamiliar executable runs, which is why a freshly patched game can hitch on its first launch and not afterwards.
5. Do the task, then turn real-time protection back on. Reason: Windows will re-enable it anyway — typically at the next reboot, and often sooner — so switching it back yourself just removes the window where you are unprotected without knowing it.

If the toggle flips itself back within seconds, or is greyed out with a “Your IT administrator has limited access to some areas of this app” message, then Tamper Protection or a policy is enforcing it — see the next section.

Managed method: Group Policy (Pro, Enterprise, Education, or Intune)

This is the route for a lab machine, a test bench, or a corporate device where an administrator has decided Defender must stay off. Windows Home has no Group Policy Editor, so Home users must use the registry values in the table above instead — the policy editor only writes those keys.

1. Turn Tamper Protection off first. Windows Security → Virus & threat protection → Manage settings → Tamper Protection. Reason: with it on, Defender treats registry and policy changes as tampering and silently reverts them. On an Intune-managed device this setting is controlled centrally and cannot be changed locally.
2. Open gpedit.msc and navigate to Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Real-time Protection.
3. Set “Turn off real-time protection” to Enabled. Reason: this is the one Defender policy that still maps cleanly to a real-time behaviour on current builds. The sibling policy “Turn off Microsoft Defender Antivirus” writes DisableAntiSpyware and does nothing on client Windows any more.
4. Run gpupdate /force and reboot. Reason: the policy engine applies at boot; a reboot also clears the existing engine state.
5. To undo: set the policy back to Not Configured, run gpupdate /force, reboot, and re-enable Tamper Protection.

Third-party antivirus: the supported way to get Defender “off”

When you install an antivirus product that registers with Windows Security Center — Bitdefender, ESET, Norton and similar are the long-standing examples — Windows automatically disables Defender’s real-time protection and places the engine in passive mode. Defender remains installed and may still run periodic scans or provide endpoint-detection data, but it stops competing with your chosen AV. This is the only method Microsoft supports and documents, and it is the one to choose if you genuinely want Defender inactive all the time. Uninstalling the third-party AV hands control straight back to Defender, so you never end up with no protection at all.

Safer alternatives if the real goal is gaming performance

Disabling an antivirus to gain frames is usually the wrong trade. The measurable cost in modern Windows comes from scanning game folders during installs, patches and shader compilation, not from idle play. These options address that directly:

• Folder exclusions. Windows Security → Virus & threat protection → Manage settings → Exclusions → Add a folder. Add only the specific install directory, not the whole drive. A worked example: a 12-game Steam library at D:\SteamLibrary might hold roughly 700–900 GB. Excluding that single folder removes all of it from both on-access and on-demand scanning — which also means anything dropped there runs unchecked, so never exclude a Downloads folder, a mods folder you populate from untrusted sources, or a whole drive.
• Process exclusions. Add the game’s own executable (for example game.exe) rather than the launcher, since the launcher is what handles patches and downloads.
• Schedule scans. Set the weekly full scan to run overnight instead of mid-session, and avoid running a full scan manually before a gaming session.
• Check Controlled Folder Access. It is off by default, but if you enabled it and a game cannot write saves to Documents, allow that game’s executable rather than turning the feature off wholesale.
• Safe Mode for locked files. The Defender service does not start in Safe Mode, so a file it keeps locking can be moved or replaced there.
• Sandbox or VM for risky tools. Trainers, cracks and unknown mod loaders belong in Windows Sandbox or a virtual machine, where the whole point is that they cannot touch your real system.

How to choose

Frequently Asked Questions

Can I permanently disable Microsoft Defender in Windows 11?

Not on a personal PC, no. The DisableAntiSpyware registry value and its matching Group Policy have been ignored on client Windows since version 2004, and Tamper Protection reverts local changes to the remaining settings. The only permanent, supported way to keep Defender inactive is to install a third-party antivirus that registers with Windows Security Center, which places Defender in passive mode.

Why does real-time protection turn itself back on?

The toggle in Windows Security is designed as a temporary pause, not a setting. Windows re-enables real-time protection at the next reboot and frequently before that, and Tamper Protection actively reverts changes made outside the Windows Security interface. If the switch will not stay off, assume something is enforcing it — a policy, Tamper Protection, or a management platform.

Does disabling Defender increase FPS?

In practice the gain is small and mostly limited to loading and patching, not to steady-state frame rates. Defender’s real-time engine is largely idle while a game is running and its assets are already open; the noticeable cost shows up during installs, patch downloads and shader compilation, where tens of thousands of files are written and read. Excluding the game folder addresses that specific cost.

Is it safe to play games with Defender turned off?

Only for a short, deliberate window and only if you are not browsing, downloading or installing anything else in that period. With real-time protection off there is no on-access scanning at all, so a malicious mod, trainer or installer runs unchecked. Turn it back on as soon as the task is finished rather than waiting for Windows to do it.

Will disabling Defender break Windows Update or the Microsoft Store?

No. Defender and Windows Update are separate components, and neither the toggle nor a real-time protection policy affects update delivery. Aggressive third-party “Defender removal” tools are a different matter — they can break Windows Security Center registration and leave the OS in an unsupported state, which is why Microsoft does not provide an uninstall path for Defender on client Windows.

Does installing another antivirus automatically turn Defender off?

Yes, as long as the product registers with Windows Security Center, which all mainstream consumer suites do. Defender’s real-time protection is disabled and the engine drops into passive mode, where it stays installed but stops scanning alongside your chosen AV. Removing that antivirus re-enables Defender automatically, so you are never left with no protection.