How to Disable Windows Defender in Windows 10/11

Lee Stanton December 18, 2023

Windows Defender is a free, built-in, comprehensive antivirus tool with reliable protection. However, there are some drawbacks to using it. It is resource-intensive and will continue running in the background after being switched off unless permanently disabled. The software can also interfere with other antivirus/malware protection applications, although many have adapted to a coexistence.

How to Disable Windows Defender in Windows 10/11

Regardless, Microsoft has not made the process of disabling Windows Defender easy. If you turn it off in the Virus & threat protection settings, it reverts to being on after a short while or after rebooting, and it does so without warning.

If you do not need it, there are many ways to disable it permanently. Read on for three methods to deactivate Windows Defender for good.

Disable Windows Defender using Another Antivirus/Antimalware Application

Most antivirus/antimalware programs automatically disable Windows Defender to effectively utilize the resources and functions that protect your system/network and prevent incompatibilities. Regardless, this method is perhaps the easiest way to disable Defender. Microsoft has adapted its Windows Security functions to accommodate third-party antivirus/antimalware applications. It allows the developers to change the security options through various codes and commands and integrate them into their installation files.

Disable Windows Defender Using Group Policy Settings

The second way to disable Windows Defender is to use the Group Policy security tool, but you must first enable/install the Group Policy Editor (gpedit.msc) if on Windows 10 or 11 Home Edition and turn off Tamper Protection in the Settings menu for all Windows releases. Follow the steps below to add gpedit or skip to the next section if enabled.

How to Add Group Policy Editor to Windows 10/11 Home Edition

The Group Policy Editor needs to exist and be activated before you can disable Windows Defender using it. Microsoft thinks Home Edition users don’t need the feature since they don’t have a network of users or applications that they need to manage. However, the lack of the policy console may stem from Microsoft’s desire to push/promote higher versions like Pro and Enterprise or prevent commercial entities from using the Home Edition. Of course, that is just an assumption, but it makes sense.

Regardless, here is how to enable/install the Group Policy Editor in Windows 10/11 Home Edition releases.

Type “cmd” in the Cortana search box. Select “Run as Administrator.”
Copy and paste the following command in Windows 11 Home Edition:

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")

It will take three or more minutes to complete. If it appears stuck, it may not be. Try minimizing and maximizing the window or clicking off of the window and back on it.
Once the first command finishes, copy/paste this command:

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")

It will take three or more minutes to complete. If it appears stuck, it may not be. Try minimizing and maximizing the window or clicking off of the window and back on it.
After the second command finishes, type “gpedit.msc” in the Cortana search box on Windows 10/11 Home, then select it. If it doesn’t appear, you need to use the Command Prompt. No administrator privileges are required.

If you’ve completed all the steps above correctly, the Group Policy Editor will launch in Windows 10/11 Home Edition, even after rebooting. If you have issues, try copying/pasting the following two commands in an admin terminal, one at a time:

foreach ($F in Get-ChildItem -Path "$env:SystemRoot\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") {DISM /Online /NoRestart /Add-Package:"$F"}

foreach ($_ in (Get-ChildItem -Path "$env:SystemRoot\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum")) {DISM /Online /NoRestart /Add-Package:"$_"}

The next step for any Windows 10/11 edition is to disable “Tamper Protection” to allow changes that remain after restarting/rebooting.

How to Disable Tamper Protection on Windows 10/11

Before adjusting Group Policy settings, you must ensure that “Tamper Protection” is disabled, no matter what Windows version you use. Otherwise, changes won’t go through or will remain after rebooting. Here’s how to do it.

Open “Windows Powershell.”
Copy/paste the following command:

Get-MpComputerStatus
Confirm that “IsTamperProtected” is set to “False.” If not, go to “Start -> Settings.”
Choose “Privacy & security -> Windows Security,” then select “Virus & threat protection.”
Click on “Manage settings.”
Scroll down and toggle “Tamper Protection” to the off position.
Choose “Yes” to confirm the action.
In the “Tamper Protection” section, a message will display stating that your device may be vulnerable. You can safely close the window.

How to Disable Microsoft Defender Using Group Policy Settings

To adjust Group Policy Settings, you must ensure that “Tamper Protection” is disabled. See the above instructions.

Once you confirm that “Tamper Protection” is disabled, you can access the Group Policy Editor (gpedit.msc) to turn off Windows Defender. Remember that for Windows 10 or 11 Home Edition, you must first activate the Group Policy Editor using the process mentioned in the first section above. You also need to ensure that “Tamper Protection” is turned off, as mentioned above. Here’s how to disable Windows Defender using gpedit.msc.

From the Taskbar, click the “search icon” and type “gpedit.msc,” then click the result to run the Group Policy Editor.
In the app’s window on the left pane, select “Computer Configuration -> Administrative Templates,” then double-click on the “Windows Components” folder.
Scroll down and double-click on the “Microsoft Defender Antivirus” folder.
Right-click on “Turn off Microsoft Defender Antivirus.”
Choose “Edit.”
Check the “Enabled” box in the popup window, then choose “Apply,” followed by “OK.”
Scroll down and right-click on “Allow antimalware service to remain running always,” then choose “Edit.”
This time, check the “Disabled” option, then click “Apply,” followed by “OK.”
Scroll up and double-click on the folder named “Real-time Protection.”
Right-click on “Turn off real-time protection,” then choose “Edit.”
Check the “Enabled” box, then click “Apply” followed by “OK.” Close the window.

Now, you have configured the group policy. Next, you’ll need to set up a Task Scheduler entry to stop certain services from running and avoid errors now that Windows Defender has been disabled.

Search for “Task scheduler” in the Cortana search box, then open it.
Expand the “Task Scheduler Library” folder in the left pane.
Navigate to “Microsoft -> Windows -> Windows Defender” in the left pane.
Right-click and choose “Disable” on the following four tasks:
- Windows Defender Cache Maintenance
- Windows Defender Cleanup
- Windows Defender Scheduled Scan
- Windows Defender Verification
Close Task Scheduler.

Now, you need to update the computer to the adjusted group policy settings and user policies:

Type “cmd” in the Cortana search box, then choose “Run as administrator” in the “Command Prompt” app options.
Run the following command:

gpupdate/force

Windows Defender should now be disabled and will not start up with Windows.

Disable Windows Defender by Modifying the Registry

Modifying the registry is another way to “potentially” deactivate Windows Defender protection. Like the Group Policy option, this method requires the “Tamper Protection” setting to be disabled and all Defender options to be turned off. Doing so stops the Defender settings from being automatically adjusted/reactivated. Follow these steps to do that:

Navigate to “Settings -> Update & Security -> Open Windows Security,” select “Virus & threat protection,” then click “Manage Settings” or simply click the “Windows Security” icon in the taskbar.
Disable all Defender Options: Turn off “Real-time protection,” “Cloud-delivered protection,” and “Automatic sample submission.”
If not done already, disable “Tamper Protection” (see section above). This step is crucial.
Right-click on the “Start Menu” and select “Run.”
Type “regedit” in the text field, then press “Enter.”
In the Registry Editor, insert the following path in the “address field” and press “Enter.”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

To edit or add a value to this folder, change the owner first. By default, the owner is System. Follow these steps to change the folder owner:

Right-click on the “Windows Defender” folder, then choose “Permissions.”
Click on “Advanced.”
Click on “Change” in the “Owner:” field.
Choose “Advanced” in the “Select User or Group” window.
Click “Find Now.”
Select the “Administrators” group. Click “OK,” then “OK” again to confirm the changes.
Check off the “Replace owner on subcontainers and objects” box.
Next, check off the “Replace all child object permission entries with inheritable permission entries from this object” box.
Click “Apply,” then select “Yes” in the “Windows Security” warning popup.
Click “OK” again to close the advanced security settings window.
In the “Permissions for Windows Defender” window, go to the “Permissions for Administrators” section and select the “Allow” box next to the “Full Control” option.
Click “Apply” then “OK” to confirm the change.

Finally, to edit the registry:

Return to the “Windows Defender” branch/folder in the Registry Editor (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender).
Right-click any white space within the right pane, select “New,” and choose “DWORD (32-bit) Value.”
Create a total of three “DWORD (32-bit)” values using “Step 2” above.

Name/rename the three values to the following:
- DisableAntiVirus
- DisableAntiSpyware
- ServiceStartStates
Right-click each new value from above, select “Modify,” then change the “Value data” field to “1,” then click “OK.” Close and reboot.

Once your computer restarts, Windows Defender should be disabled.

Disable Windows Defender Using Autoruns

You can permanently disable Windows Defender using the Autoruns for Windows utility tool. Here’s how:

Download the latest version of Autoruns for Windows.
Open the downloaded file and right-click on the Autoruns folder to Extract All. Consider extracting the folder to your desktop for easy access.

Now you’ll need to disable permanent protection and boot in safe mode:

Press the Windows icon from the taskbar, then choose Settings.
Choose Privacy & security, Windows Security, then Virus & threat protection.
Under the Virus & threat protection section, select Manage settings.
Press the Real-time Protection and Tamper Protection sliders to deactivate them.
Next, to put your computer in Safe Mode, enter a search to find the System Configuration app, then open it.
In System Configuration, select the Boot tab.
Under Boot options, check the Safe boot box, and the Minimal option will set automatically.
Hit Apply, OK, then Restart.
Open the Autoruns folder on your desktop, click the Autoruns64.ex file, then Run to start it.
An Autoruns License Agreement window will display. If you agree with the terms, click Agree to continue.
In the Autoruns window, choose the Services tab.
By default, Windows services are hidden. To make them visible, click on Options from the main menu, then uncheck the Hide Windows Entries.
Go through the list of services for Windows Defender and uncheck the WinDefend box. This will disable the automatic startup for Windows Defender each time the computer reboots.
Now close Autoruns, then reboot your computer into normal mode.

To reboot your computer into normal mode:

Press the Search icon on the taskbar and select System Configuration.
Check the Normal startup option.
Click Apply, OK, then Restart.

Once your computer has rebooted, launch Task Manager and check if the Windows Defender service is running:

Open Settings to see the Virus & threat protection status. To get there, go to Privacy & security, Windows Security, Virus & threat protection, then Home.
Verify that the Virus & threat protection status is set to Unknown.

Note: Avoid clicking on the Defender tile as it updates its information or displays the “Unknown” status. If you click on it during that time, Defender will be enabled again.

Time to Stop Defending Windows Defender

By default, the free antivirus software Windows Defender is set to remain enabled, even after being turned off via Virus & threat protection. To stop Windows Defender for good requires a permanent or “hard” deactivation. This can be done by updating the policy, modifying the registry, or disabling it using the “Autoruns for Windows” utility tool. Any of these three methods ensures Defender will not reactivate at will.

Let us know which option worked/didn’t work for you in the comments below!