How to Turn Off Virus and Threat Protection in Windows 11

A straightforward process — but understand what you’re turning off before you do it

---

Windows 11’s Virus and Threat Protection is part of Microsoft Defender — the built-in antivirus that runs in the background protecting your system.

There are legitimate reasons to turn it off temporarily — installing software that Defender incorrectly flags, troubleshooting a conflict, or testing system behavior without active scanning.

The process is straightforward, but Windows 11 is designed to make it slightly inconvenient on purpose because leaving it off permanently creates real security risk.

Here’s how to do it, what each option controls, and what to be aware of.

---

Turn Off Real-Time Protection

Real-time protection is the component that actively scans files and programs as they’re accessed. This is what most people mean when they want to turn off Virus and Threat Protection — stopping Defender from scanning in the background and blocking programs it flags.

Go to Settings → Privacy and Security → Windows Security → Virus and Threat Protection. Click Manage Settings under the Virus and Threat Protection Settings section. Toggle Real-Time Protection to Off.

Windows will warn you that your device may be vulnerable. Confirm and the real-time scanning stops immediately.

This is temporary by design. Windows 11 automatically re-enables real-time protection after a period of time — typically within 15 minutes to a few hours — even if you turned it off manually. This is intentional Microsoft behavior and cannot be changed through this method alone.

---

Turn It Off Permanently Using Group Policy

If you need real-time protection off for longer than the automatic re-enable period, Group Policy gives you a persistent setting. This method is available on Windows 11 Pro, Enterprise, and Education — not on Windows 11 Home.

Press Windows + R, type gpedit.msc, and press Enter. Navigate to:

Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Real-Time Protection

Double-click Turn Off Real-Time Protection. Select Enabled — confusingly, enabling this policy turns the protection off. Click OK.

Also navigate up one level to Microsoft Defender Antivirus and find Turn Off Microsoft Defender Antivirus. Set it to Enabled to disable Defender entirely at the policy level.

Restart your computer for the policy to take full effect.

---

Turn It Off on Windows 11 Home Using Registry

Windows 11 Home doesn’t include Group Policy Editor, so the registry is the equivalent method for persistent disabling.

Press Windows + R, type regedit, and press Enter. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

If a Windows Defender key doesn’t exist, right-click the Microsoft folder, select New → Key, and name it Windows Defender.

Inside that key, right-click in the right panel, select New → DWORD (32-bit) Value, name it DisableAntiSpyware, and set its value to 1.

Also navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection

Create the Real-Time Protection key if it doesn’t exist. Add a DWORD value named DisableRealtimeMonitoring and set it to 1.

Restart your computer after making these changes.

---

Turn Off Specific Components Without Disabling Everything

Rather than turning off all protection, you can disable specific components that are causing issues while leaving the rest active. This is a safer approach when you have a specific reason for the change rather than needing everything disabled.

In Windows Security → Virus and Threat Protection → Manage Settings you’ll find individual toggles for:

Cloud-Delivered Protection — disabling this stops Defender from checking files against Microsoft’s cloud database of known threats. Turns off without affecting local scanning.

Automatic Sample Submission — stops Defender from sending suspicious files to Microsoft for analysis. Useful for privacy concerns without reducing local protection.

Tamper Protection — this prevents external applications from modifying Defender’s settings. You need to turn this off before Group Policy or registry changes to Defender will take effect. Turn it back on after making your changes if you want to lock the settings.

---

Add an Exclusion Instead of Turning Off Protection

If you’re turning off Virus and Threat Protection because Defender is blocking a specific program or file, adding an exclusion is a much better approach than disabling protection entirely. An exclusion tells Defender to ignore a specific file, folder, file type, or process while continuing to protect everything else.

Go to Windows Security → Virus and Threat Protection → Manage Settings → Add or Remove Exclusions. Click Add an Exclusion and choose whether to exclude a file, folder, file type, or process. Navigate to the item Defender is blocking and add it.

This resolves the vast majority of cases where someone wants to turn off protection — they don’t actually need everything disabled, they just need one specific thing allowed through. Exclusions are more surgical and significantly less risky than disabling the entire protection system.

---

Turn Off Tamper Protection First

If you’re trying to make changes to Defender’s settings through Group Policy or the registry and the changes aren’t sticking, Tamper Protection is almost certainly why. Tamper Protection is designed to prevent exactly this — it blocks external modifications to Defender’s configuration to protect against malware that tries to disable antivirus software.

Go to Windows Security → Virus and Threat Protection → Manage Settings → Tamper Protection. Toggle it off. Now your Group Policy and registry changes will take effect.

Consider turning Tamper Protection back on after you’ve made your changes if you want to lock them in place and prevent other software from modifying them.

---

What Happens When Defender Is Off

Understanding what you’re losing helps you make an informed decision about whether turning it off is the right call.

With real-time protection off, files are no longer scanned as they’re accessed — malware can be downloaded, installed, and run without Defender intervening. Browser downloads, email attachments, USB drives, and network files are all unchecked.

Windows Security Center will show a red warning indicator while protection is off and will periodically prompt you to turn it back on. Windows Update continues to work and will still deliver Defender definition updates even while it’s disabled.

If you’re leaving Defender off for an extended period, make sure you have another antivirus solution active. Running a Windows 11 machine with no antivirus protection connected to the internet is a significant security risk regardless of how careful you are with what you download.

---

Re-Enable Protection

Turning Defender back on is straightforward regardless of how you disabled it.

For the settings toggle method, go back to Windows Security → Virus and Threat Protection → Manage Settings and toggle Real-Time Protection back on.

For Group Policy, go back to the same policy locations and set the policies to Not Configured rather than Enabled. Restart your computer.

For registry changes, navigate back to the same registry keys and either delete the DWORD values you created or change their data value from 1 back to 0. Restart your computer.

---

A Quick Checklist

• For temporary disable — Windows Security → Virus and Threat Protection → Manage Settings → toggle Real-Time Protection off
• Turn off Tamper Protection first if settings changes aren’t sticking
• For persistent disable on Pro/Enterprise — Group Policy Editor → Microsoft Defender Antivirus → Real-Time Protection
• For persistent disable on Home — Registry Editor → DisableAntiSpyware and DisableRealtimeMonitoring DWORD values
• For a specific program being blocked — add an exclusion instead of disabling everything
• To re-enable — toggle back on in settings, set Group Policy to Not Configured, or set registry values back to 0

---

The Bottom Line

Turning off Virus and Threat Protection in Windows 11 is straightforward but intentionally temporary through the settings toggle — Windows re-enables it automatically after a short period. For a persistent change, Group Policy on Pro versions or registry edits on Home versions are required.

In most cases where someone wants protection turned off, adding an exclusion for the specific file or program being blocked is a better solution than disabling everything. It solves the immediate problem without leaving the entire system unprotected.

Turn it off for what you need to do, then turn it back on — or add an exclusion and don’t turn it off at all.