Why you might disable Microsoft Defender, and what happens when you do

Microsoft Defender is built into Windows and runs by default. You can turn it off entirely, turn off specific features like real-time scanning, or exclude certain files and folders from scanning. Disabling it completely leaves your device without active malware protection — which is safe only if you are replacing it with another antivirus program, or if you are doing a specific task that Defender is blocking and you understand the risk.

The most common reason to disable Defender is that another antivirus program conflicts with it. Running two antivirus programs at the same time causes them to scan each other's files, slow your device, and sometimes crash. If you are installing a different antivirus, you should disable Defender first. The second common reason is that Defender flags a file you trust — a game mod, a development tool, or software from a small vendor — as a threat. In that case, excluding the file or folder is safer than disabling the whole program.

When Defender is off, Windows will show you a warning in the system tray (bottom right corner). This is intentional — it reminds you that you are unprotected. If you disable Defender and then forget about it, your device is vulnerable until you turn it back on or install another antivirus.

Key Takeaways

  • You can disable all of Defender, disable only real-time scanning, or exclude specific files — choose based on why you need to turn it off.
  • If you are installing a different antivirus program, disable Defender first to prevent the two from conflicting.
  • Excluding a single file or folder is safer than disabling Defender entirely if you trust one specific piece of software.
  • Windows will warn you when Defender is off, but the warning disappears after a few seconds — check your settings periodically to confirm it is still on.

Disable real-time scanning without turning off Defender completely

Real-time scanning is the feature that checks files as you open them. Disabling it stops Defender from blocking or quarantining files in the moment, but Defender still runs in the background and you can still run manual scans. This is the middle ground: you keep some protection while stopping Defender from interfering with a specific task.

Open Windows Security (search for it in the Start menu). Click Virus & threat protection on the left. Under "Virus & threat protection settings," click Manage settings. Toggle off Real-time protection. Windows will ask you to confirm — click Yes. The toggle will turn gray, and real-time scanning stops when ready.

To turn it back on, follow the same steps and toggle it back on. Real-time protection will resume the moment you flip the switch.

Exclude a specific file or folder from scanning

If Defender is blocking one file you trust — a game, a tool, a downloaded installer — you can tell Defender to ignore it. The rest of your device stays protected. This is the safest option if you only need to use one specific piece of software.

Open Windows Security and go to Virus & threat protection. Scroll down to "Virus & threat protection settings" and click Manage settings. Scroll down further to Exclusions and click Add or remove exclusions. Click the + button and choose whether you are excluding a file, folder, file type, or process. Navigate to the file or folder you want to exclude and select it.

Defender will stop scanning that file or folder. If you change your mind, return to the same menu, find the exclusion in the list, and click the trash icon to remove it.

Disable Defender completely using Windows Security settings

This turns off all Defender features. Your device will have no active antivirus protection until you turn Defender back on or install another program. Only do this if you are about to install a different antivirus, or if you understand that your device is unprotected.

Open Windows Security and go to Virus & threat protection. Click Manage settings. Toggle off Real-time protection. This disables the active scanning, but Defender itself is still technically running. To fully disable Defender through this menu, you have disabled the main feature it uses. If you want to go further, you will need to use the Group Policy Editor or Registry Editor (see the next section).

For most people, turning off real-time protection is enough. The program is no longer actively watching your files, and you can install your replacement antivirus without conflict.

Disable Defender completely using Group Policy Editor (Windows Pro and Enterprise only)

The Group Policy Editor is a settings tool available only on Windows Pro, Enterprise, and Education editions — not on Windows Home. It lets you disable Defender at a deeper level so it does not restart itself.

Press Windows key + R to open the Run dialog. Type gpedit.msc and press Enter. Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. Find the setting called Turn off Microsoft Defender Antivirus. Double-click it and select Enabled. Click explore and then OK. Restart your computer.

Defender will be disabled after the restart. To turn it back on, return to the same setting, select Disabled or Not Configured, and restart again.

Disable Defender on Windows Home using Registry Editor

Windows Home does not have Group Policy Editor, but you can disable Defender using Registry Editor, which is more fragile — a mistake can cause problems. Only use this if you are comfortable editing the registry, or if you have already tried the Windows Security method and it is not working.

Press Windows key + R, type regedit, and press Enter. Navigate to HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Microsoft > Windows Defender. If the Windows Defender folder does not exist, right-click on Windows, select New > Key, and name it Windows Defender. Right-click in the empty space on the right side, select New > DWORD (32-bit) Value, and name it DisableAntiSpyware. Double-click the new entry and change the value from 0 to 1. Click OK and close Registry Editor. Restart your computer.

Defender will be disabled after the restart. To re-enable it, change the value back to 0 and restart again. If you make a mistake in the registry, you can cause Windows to malfunction, so take your time and double-check each step.

Turn Defender back on

If you disabled Defender through Windows Security, open Windows Security, go to Virus & threat protection, click Manage settings, and toggle Real-time protection back on. If you disabled it through Group Policy Editor or Registry Editor, follow the same steps you used to disable it, but select Disabled or Not Configured instead of Enabled, and restart your computer.

After Defender restarts, Windows will show a notification that it is active again. You can verify it is running by opening Windows Security and checking that the green checkmark appears next to "Virus & threat protection."

What to watch for after disabling Defender

If you disabled Defender but did not install a replacement antivirus, Windows will show a persistent warning in your system tray and in Settings. The warning is there to remind you that you are unprotected — it is not a false alarm. If you see it and you did not mean to disable Defender, turn it back on when ready.

If you disabled Defender to install another antivirus, install that program as soon as possible. Most antivirus installers will detect that Defender is off and will not complain. Once the new program is installed and running, you can leave Defender off — the new program will protect you instead. If you install the new antivirus and then change your mind, you can turn Defender back on and run both (though this is not recommended for performance reasons).

If you excluded a file from Defender and then later decide you do not trust it, remove the exclusion by going back to Windows Security > Virus & threat protection > Manage settings > Exclusions, finding the file in the list, and clicking the trash icon.

Frequently Asked Questions

Will disabling Defender slow down my computer?

Turning off real-time scanning may speed up your device slightly, especially during large file transfers or installations, because Defender is no longer checking every file. The difference is usually small on modern computers. If you are disabling Defender to install a different antivirus, the new program will use similar resources, so you may not see a speed improvement overall.

Can I disable Defender temporarily and have it turn back on automatically?

No. Once you disable Defender, it stays off until you manually turn it back on. Windows will warn you that it is off, but the warning does not re-enable it. If you want Defender to resume after a certain time, you will need to set a reminder to turn it back on yourself.

What if I disable Defender and then forget to turn it back on?

Your device will be unprotected from malware. Check your system tray (bottom right corner) periodically — if you see a warning shield icon, Defender is off. Open Windows Security and turn real-time protection back on. If you have been without protection for a while, consider running a full antivirus scan from another program or taking your device to a technician.

Does disabling Defender affect Windows updates?

No. Windows updates are separate from Defender and will continue to read and install normally. Disabling Defender does not stop Windows from protecting itself through patches and security updates.

Can I disable Defender if I am using a work or school computer?

Probably not. Work and school devices are usually managed by an administrator who has locked down Defender settings. If you try to disable it, you will see an error message saying it is controlled by your organization. Contact your IT department if you need Defender disabled for a legitimate work reason.