How to disable Microsoft Defender (Windows Defender) in Windows 11

How to disable Microsoft Defender (Windows Defender) in Windows 11

If for some reason you need to disable Windows 11 Defender, now called Microsoft Defender permanently or temporarily, you can do it in several ways: manually or by using third-party programs and scripts.

This tutorial details the working ways to disable Microsoft Defender in Windows 11, some of which work permanently, others only disable it temporarily.

Disabling antivirus protection in the Windows Security window

A basic way to disable Windows 11 Defender, which only works for a short time before the system turns it back on, is to use the "Windows Security" interface. Note: if the reason you need to disable the antivirus is because it is deleting files you want, you can simply add folders with them to the exceptions.

Note that the following is your responsibility: A program that Windows Defender won't let you use may not really be worth running. To disable Microsoft Defender in your settings, simply follow these steps

  1. Open the Windows Security window using the icon in the notification area, or Settings – Privacy and Security – Windows Security.
  2. Open protection against viruses and threats.
  3. Under “Virus & threat protection settings”, click “Manage settings”.
  4. Disable «Real-time protection», «Cloud protection», «Automatic sending of samples». If you disable Microsoft Defender to use any software that modifies its operation, please also disable the “Counterfeit Protection” item in the same window.
  5. If any program does not start with the message "Malicious file" after you have done this, please go to "Manage applications/browser" in the "Windows Security" window, open "Reputation-based protection settings" and disable the check and block potentially unwanted applications, and in the properties of the file itself, if it was downloaded from the Internet, check “Unblock” and apply the settings.

This will temporarily disable the antivirus protection features of Microsoft Defender. However, after some time or after a reboot, the protection will be activated again.

Script to completely disable Windows Defender 11

ToggleDefender – A simple bat-script that completely disables all protection features of Windows Defender, SmartScreen filter, notifications and the services they use. One caveat: it can be difficult to turn your antivirus back on after using the script, so I recommend creating a system restore point beforehand.

Using the script to disable the defender:

  1. Go to Windows Security – Virus & Threat Protection – Manage Virus & Threat Protection settings and turn off Tamperproof.
  2. Download the script from the official website https://www.majorgeeks.com/files/details/toggledefender.html
  3. Open the properties of the downloaded file (right click – properties), check the “Unlock” box and click “OK”.
  4. Run the downloaded script.
  5. After a short time, a window will appear with the current status of Windows Defender and a suggestion to disable it: “Turn off Windows Defender?”. Click "Yes".
  6. In a short time (a few seconds, no notifications will appear), the Defender will be completely disabled, but it is advisable to restart the computer as well.
  7. Within the script in the "Personal Configuration Tweak" section there are additional options, such as options to enable and disable sending images to the cloud or protection against potentially unwanted programs, which can be uncommented so that they also apply when using the script.

If you also want to remove the Windows Security icon from the taskbar notification area, simply disable its autorun (read more: How to remove programs from autorun in Windows 11).

Completely disable Microsoft Defender antivirus protection in the local Group Policy editor and in the registry editor

To use this method, you will first need to disable the “Tamper Proof” option in Windows Defender, to do so:

  1. Open the Windows Security window, go to “Virus and threat protection”.
  2. Click “Manage settings” under “Virus & threat protection settings”.
  3. Disable the "Tamper Proof" option.

Other steps can be done in the Registry Editor (in Windows 11 any edition) or in the Local Group Policy Editor (only in Pro and Enterprise).

In the registry editor.

  1. Press the keys Win + R on the keyboard, enter regedt and press Enter.
  2. Go to HKEY_LOCAL_MACHINE\NSOFTWARE\NPolicies\NMicrosoft\NWindows Defender
  3. Right-click in the right pane of the registry editor, select Create – DWORD Parameter and create a parameter called Disable AntiSpyware.
  4. Double click the parameter and set the value 1 For him.
  5. In the same section, create a parameter Disable AntiVirus and set the value to 1 For him.
  6. In Windows Defender, create a subsection called Real-time protectionand in it there is a DWORD parameter with the name DisableRealtimeMonitoring and a value of 1.
  7. Updated: option of this, step 7, does not seem to work anymore, the settings return to their original state. In the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender registry hive (you will need to gain rights to change the registry hive, you may need to restart in safe mode), create DWORD parameters called DisableAntiSpyware, DisableAntiVirus, and ServiceStartStates and set the value to 1 for each one of them, restart the computer. To disable protection against potentially unwanted programs, change the value of the PUAProtection parameter in this section to 0.
  8. If you want to disable services relevant to Windows Defender, restart your computer in safe mode, and then change the value of Start en 4 in each of the following sections of the registry:
    HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\Sense\ HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\WdBoot\ HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\WdFilter\ HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\WdNisDrv\ HKEY_LOCAL_MACHINE \NisSYSTEM\SServicesCurrentControl HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\

After performing the above actions, restart the computer, the protection will be disabled.

In the local group policy editor

  1. Right-click the Start button, select Run, type gpedit.msc and press Enter.
  2. In the Local Group Policy Editor that opens, go to Computer Configuration – Administrative Templates – Windows Components – Microsoft Defender Antivirus.
  3. Double-click the Turn off Microsoft Defender Antivirus program option, select Enabled, and apply the settings.
  4. Go to the “Real-time protection” subsection and enable the “Disable real-time protection” policy.

You may need to restart your computer after performing the steps above.

Total shutdown in Defender Control

free utility Control of defenders – One of the most effective utilities to completely disable Windows Defender and then enable it when needed, regularly updated with the latest protection changes.

Warning: the utility has many detections in VirusTotal. Most say it works to disable Microsoft Defender and "Not a Virus" detection, but there are others. Total security cannot be guaranteed.

The order of use of the utility would be as follows:

  1. Go to Windows Security – Antivirus and Threat Protection – Manage Settings (under Antivirus and Threat Protection Settings) and turn off the Anti-Spoofing option.
  2. Download the Defender Control file from the official website https://www.sordum.org/9480/defender-control-v2-1/
  3. Unzip the archive to a folder, which must first be added to Windows Defender exceptions (or disabled in the first way). There is another file inside the file, the password is I askedUnzip it too.
  4. Right-click the dControl file in the folder, select "Properties", check "Unlock" and click OK. Run the dControl.exe file.
  5. The program's interface is very simple, in Menu – Languages ​​you can activate the Russian language of the interface. There are 3 states with corresponding color scheme: Green – Windows Protector enabled, Red – disabled, Orange – partially disabled (eg in settings).
  6. To completely disable Windows Defender in Defender Control, just click the appropriate button and wait for the status to change.

Once disabled, you can close the program, but it's best to save it somewhere, or remember where to download it if necessary in case you need to turn Microsoft Defender on again.


Creative Stop All About Technology
A How To.