How to Disable Defender in Windows 11

Open Group Policy To The Defender Folder

Here is how to permanently disable Defender in Windows 11. Microsoft Defender is an antivirus solution that comes bundled with the OS. It is enabled by default, and remains active until the user installs a third-party security app.

The app was previously known as "Windows Defender", but Microsoft renamed it in recent releases of Windows 10 and Windows 11. Defender runs in the background and provides a number of protection levels, including real-time app activity monitoring, network file checker, anti-tamper protection for its own engine, and more. It also responsible for running periodic scans of the critical areas of the operating system.

Microsoft Defender is a signature based anti-virus software that checks files against a database of well-known patterns. This allows it to provide basic protection for user data.

Some users would like to permanently disable Microsoft Defender. The reasons for that may vary. Some aren't happy with its high resource usage. Others name its low efficiency. Finally, in very specific cases, an installed third-party security solution may be improperly detected, causing Defender to remain up and running with even more resource consumption.

The only problem here is that Microsoft doesn't allow you to permanently disable Defender from its settings. Once you disable it using the appropriate option, it quickly returns to the enabled state after a short period of time. The situation is even worse, as you can't see exactly when it will be automatically re-enabled. So, let's see how to turn it off permanently.

Disable Microsoft Defender in Windows 11

To permanently disable Defender in Windows 11, do the following.

  1. Download the following REG files in the ZIP archive.
  2. Extract them to any folder of your choice, e.g. right onto the Desktop.
  3. Now, click the Windows Security icon in the system tray.
  4. Select Virus & Threat protection in the window that opens.
  5. Now, under Virus & threat protection settings, click on the Manage Settings option.
  6. On the next page, disable the Tamper Protection option.
  7. Finally, double-click the file "Disable Defender.reg" you have downloaded.
  8. Restart Windows 11.

You are done. Microsoft Defender is now permanently turned off. The undo file is "Enable Defender.reg", which is also included in the ZIP archive.

The reviewed method works in all editions and versions of Windows 11. It sets a Group Policy option in the Registry that tells the operating system to stop using the built-in security solution.

If you have Windows 11 Pro, Education, or Enterprise edition, then you can go with gpedit.msc - the Local Group Policy Editor app. It will allow you to configure Defender using a special GUI option.

Disable Defender with the Local Group Policy Editor

  1. Press the Win + R shortcut to bring up the Run dialog and type gpedit.msc. Hit Enter to launch it.
  2. Head over the Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus folder on the left.
  3. On the right, find and double-click the Turn off Microsoft Defender Antivirus policy and set it to Enabled.
  4. Click the Apply and OK buttons to apply the change.
  5. Finally, restart Windows 11.

Done! Similar to the method reviewed earlier in this post, Defender will be permanently disabled.

Finally, an alternative to Group Policy is Winaero Tweaker. It includes an option to permanently stop the Defender app.

Using Winaero Tweaker

  1. Download the app from here, install and run it.
  2. Open the Windows Security app and disable the Tamper Protection option.
  3. Now, return to Winaero Tweaker and go to Windows Defender > Disable Defender option in the left pane.
  4. On the right, simply check the eponymous option.
  5. Restart Windows when prompted.

This will disable Microsoft Defender.

Finally, for the sake of completeness, let's see how to temporarily disable Defender in Windows 11.

Temporarily disable Defender in Windows 11

  1. Open Windows Search by clicking on its taskbar icon or pressing Win + S.
  2. Type "Windows Security" and launch the found app.
  3. Select Virus & Threat protection.
  4. On the next page, go down to  Virus & threat protection settings section and click Manage settings.
  5. On the next page, turn off the Real-time protection toggle option.

You are done. Again, keep in mind that this option simply pauses the Defender app. In a short period of time, Microsoft Defender will be re-enabled by the operating system.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won't take a lot from you, but it will help us grow. Thanks for your support!

Author: Sergey Tkachenko

Sergey Tkachenko is a software developer who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube.

9 thoughts on “How to Disable Defender in Windows 11”

  1. This doesn’t work anymore! It just resets itself and unchecks the Disable button in Tweaker after a reboot and some time. This needs to be fixed!

  2. Doesn’t work. A popup says I need an app to launch this feature, the query on the app store finds nothing.

  3. Hello.
    Thanks for great app.
    May be it would be usefull to add a feature allowing to change hotkeys for button “Up” in “File explorer”?
    All modern browsers allow do it with “Alt + Left”, buton “File explorer” makes it with “Alt + Up”.
    I have the changed hotkeys and it isn’t very convenient.

    1. alt-left is always ‘back’… both in browsers and file-explorer.
      ‘Move to parent directory’ is something browsers can’t do, and the alt-up kinda makes sense for it.

  4. I get that even when I disable defender in WinAero Tweaker, I still get scans that sometimes occur when resuming the machine from sleep or booting up.
    Those scans are then whining that they ‘took action’ on a threat:

    “`
    Detected:VirTool:Win32/DefenderTamperingRestore
    Affected items:
    regkeyvalue: hklm\software\policies\microsoft\windows defender\real-time protection\\DisableBehaviorMonitoring
    “`

    When I then check WinAero tweaker, it says defender is enabled again (or I need to re-disable it in WinAero Tweaker).

    Is there something that can be done about this?
    (I can’t click those ‘threats’ as ‘allow threat’ or something).

  5. For the first time, Winaero failed to work. Tried to use it with the new Windows 11 IoT Enterprise LTSC 24H2 and the option to disable Windows Defender did nothing. Also trying to use TrustedInstaller failed to allow any changes to be done to the service. Looks like Microsoft has effectively blocked Winaero. Very unfortunate. Well, it was good while it lasted…

      1. Good luck! I hope you can make Winaero work again!!
        Winaero works great on Windows 10 IoT Enterprise LTSC 2021 if anyone wants to use it there.

Leave a Reply

Your email address will not be published.

Exit mobile version
Using Telegram? Subscribe to the blog channel!
Hello. Add your message here.