Why Does Windows Defender Keep Turning On? (How to Fix It)

I’ve shared the same frustration. You try disabling Windows Defender and it keeps turning back on. In this article, I will provide some effective fixes to prevent Windows Defender from turning itself back on.

Windows Defender provides real-time protection against cyberattacks, malware, and unauthorized data access.

However, there are several reasons why you may want to turn it off, including when you have to install an application that clashes with it or to save system resources.

In such cases, turning Windows Defender off can be challenging because it may frequently turn on automatically for various reasons. 

Here are 4 reasons why Windows Defender keeps turning on even after disabling it: 

1. Windows Defender is the default anti-malware program. 
2. Lack of an antivirus program, or an expired one.
3. Recent Microsoft updates.
4. Tamper Protection is on.

Now I’ll discuss the reasons why Windows Defender keeps turning on in greater detail.

It will also cover in-depth actions you can take to resolve this problem, from simple fixes to the more advanced hacks. 

Main reasons Windows Defender keeps turning on

One of the common issues that Windows users have, especially in Windows 10 and 11, is the real-time protection turning on by itself, even when you have turned off real-time protection. 

Here are some of the reasons why this happens: 

1. Windows Defender is the default anti-malware program

Windows Defender is the default anti-malware program for Windows devices. It is also the default application for cloud-based protection and submissions.

Therefore, it’s usually set to “on” by default.

Since its default setting is set to “on”, Windows Defender may automatically turn itself on when your computer is idle or when there is an external malware threat. 

2. Lack of an antivirus program, or an expired one

One of the common reasons Windows Defender turns itself on is to provide real-time protection when you don’t have an antivirus program installed or when your antivirus program expires.

As explained by Microsoft Support, Windows Defender is designed to protect your computer against malware and other threats. 

So if you do not have an antivirus program installed on your computer, Windows Defender will automatically turn on even if you have turned off real-time protection. 

This may also happen if you uninstall your antivirus program or when your antivirus program expires, which essentially means that your computer is unprotected against threats.

However, Microsoft Defender should automatically disable itself after installing a third-party program. 

3. Recent Microsoft updates

Microsoft periodically sends out updates that affect various registry components, some of which relate to real-time protection.

If you have installed recent Windows 10 and above updates or set automatic updates on, chances are that Windows Defender is automatically turning itself on due to these updates. 

CERN explains that, since Windows Defender is managed centrally on your computer, most virus definition updates are applied without requiring any reboot. 

For instance, there are updates to Windows 10 and over devices that prevent Windows Defender from turning itself off after installing an antivirus program.

An excellent example of such updates are updates related to tamper protection. 

Such updates can prevent Windows Defender from automatically turning off after installing another antivirus software.

So even if you turn real-time protection on, it will still turn on automatically due to this tamper protection feature. 

We’ll discuss this further shortly. 

4. Tamper Protection is turned on

One of the key components of Microsoft Defender is tamper protection.

The tamper protection feature in Windows security essentially protects your computer against external intrusion or any cyber attacks directed at whatever antivirus program you have installed. 

Even if you have an antivirus program installed, Windows Defender might automatically turn on when it detects an attempt to install malware or access data on your computer. 

Tamper protection is on by default and is available for most Windows Devices running Windows 10 or higher.

As such, any effort to either permanently disable or change the security settings in Windows 10 devices and higher may require you first to turn off tamper protection. 

The above is because even if you turn real-time protection off or disable the Windows Defender Firewall without first disabling tamper protection, chances are Windows Defender will automatically turn on. 

Deciding whether to turn Defender off or leave it on

While Windows Defender has numerous attractive features to protect your computer against malware threats and data breaches, it has its downsides, including taking up a substantial amount of disk space while also consuming many system resources. 

Additionally, if you already have an antivirus program installed, you do not need the extra strain on resources from also having Microsoft Defender on and running in the background.

On the same front, Windows Defender may prevent you from installing a third-party antivirus or other software that it detects as malware, much to your inconvenience. 

You may therefore need to either momentarily or permanently turn off Windows Defender. 

However, you’ll want to ensure that you have a reliable antivirus program before turning off Windows Defender.

As explained by Microsoft Support, turning off these protections potentially makes your computer or network more vulnerable to attacks. 

How to permanently turn Windows Defender off: Simple hacks

If you turn off Windows Defender and later realize that it is still running, the good news is that it is possible to turn it off permanently, as will be discussed shortly. 

Before taking on advanced steps to turn off Windows Defender, try out these basic troubleshooting approaches to turn this antivirus program off in Windows 10 and 11. 

How to turn off Windows Defender on Windows 10   

 Follow the following steps to turn off Windows Defender on Windows 10: 

1. Click on the Windows Start button, which should be at the bottom left-hand side of your screen to open the Start Menu. 
2. Go to the Settings icon and click on it. 

3. Under the Settings window, click on Update & Security. This should be the last option in that window.

4. After clicking on Update & Security, click on the Windows Security tab. 
5. There will be several options under protection areas. Click on Firewall & Network Protection.

6. You will see three main options in the new window: Domain network, Private network, and Public network. Switch the settings to off by clicking on each one and toggling them off. 

7. Navigate to Virus and Threat Protection and click on Manage Settings. 

8. Turn off Tamper Protection and Real-time protection. 

Note: If you are connected to a network, you may be unable to complete these steps. I recommend that you contact your network administrator in such instances. 

How to turn off Windows Defender on Windows 11

To turn Windows Defender off in Windows 11, follow the following simple steps: 

1. Click on the Windows Start button, and then navigate the Settings icon. 

2. Select Privacy & Security in the left column, then Windows Security.

3. Select Firewall & network protection. 

4. Like in Windows 10, you will get the same three network options; Domain network, Private network, and Public network. 

5. Depending on the network you are on, switch the on button to off under Microsoft Defender Firewall. 

6. Navigate to Virus & threat protection and click on Manage settings. 

7. Turn off Tamper Protection and Real-time protection.

As is the case with Windows 10, you might be unable to make these changes if you are connected to a network due to applicable network policy settings, in which case you should contact your network administrator. 

Within the Windows Security window, you can also adjust or manage other settings related to cybersecurity protection, tamper protection, and more.

How to permanently turn Windows Defender off: Advanced hacks

Because of security updates, simply turning off Windows Defender in your computer’s panel may not suffice.

If you follow the above steps and Windows Defender continues to turn itself on, consider these two alternatives:

• Turn Off Microsoft Defender using Group Policy 
• Turn Off Microsoft Defender Using a REG file 

Note: You can make edits to the Windows Group Policy and the Windows Registry to disable Microsoft Defender via these two options for both Windows 10 and Windows 11.

Let’s discuss each option in detail below.

Turning off Microsoft Defender using Group Policy 

Group policy is a Windows feature that offers access to a wide variety of advanced settings, giving you more control over the computer’s working environment. Under group policy, you can configure or manage applications, user settings, and operating systems. 

To access the Windows Group Policy feature, use the Local Group Policy editor.

While this editor is only available in select operating systems (including Windows 10 Enterprise, Windows 10 Pro, and Windows 10 Education editions), you may still be able to access it through the Run box by typing in gpedit.msc. 

If you cannot access the Group Policy editor through the Run box when not running these versions of Windows, I would recommend using the REG file option instead. 

To turn off Windows Defender using Group Policy, follow the following simple steps: 

Step 1: Set the Windows Defender Antivirus Tamper Protection to Off

Disabling tamper protection is the first critical step before changing the Group Policy or Registry data. To disable it: 

1. Click on theWindows Start button and navigate to Windows Security (You can alternatively type in Windows Security in the Windows search box), as shown in the image below. 

2. Under Windows Security, click on the Virus & Protection icon. This is the first icon, as shown in the image below. 

3. Under Virus & Threat protection, click on Manage Settings. Tamper Protection should be turned on by default. Click on Tamper Protection and set it to off. 

Step 2: Launch the Group Policy Editor

1. To open the group policy editor, you can search for the Group Policy Editor from the Start Menu or Control Panel. 

2. In this Group Policy Editor, click on Computer Configuration. 

3. Under computer configuration, navigate to Administrative Templates. 

4. Click on Windows Components, and navigate to Microsoft Defender Antivirus.

5. Under Microsoft Defender Antivirus, navigate to the Turn off Windows Defender Antivirus section. 

6.  Disable Microsoft Defender.

7. Close the Group Policy Editor once you are done.

Note: If you want to reactivate Windows Defender, you can simply click on Disabled after following the same steps. 

To make navigation more straightforward, you can follow this path in the Group Policy Editor: 

Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus

If the above process doesn’t cut it, you can turn off Windows Defender using a REG file as discussed below. 

Turning off Microsoft Defender using a REG file

REG files contain one or more registry entries. They are basically text-based files that you can import or export to the Windows registry using a given syntax. 

To switch off Windows Defender using these REG files, simply follow these steps: 

Step 1: Turn Off Tamper Protection

The first step is to turn off Windows tamper protection, making it possible to turn off Microsoft Defender antivirus.

Remember, you can’t change the values if tamper protection is on because this feature essentially protects the same security settings you’re looking to change.

To turn off tamper protection, repeat the same steps discussed in the previous option. 

Step 2: Install  REG File To Turn Microsoft Defender Antivirus Off

The next step is to install the REG files that turn Microsoft Defender Antivirus files off. There are two options in which you can do this. 

• Option 1: Download the REG file from a reliable source

In this option, all you need to do is download the REG files from a reliable source and double click on the download file. REG files are executable, so Windows will need permission to run this file as shown in the image below.

The next step is to click on RUN, and the file will make changes to the registry, Turning Windows Defender off. 

After downloading the file, right-click on the Zip file and select Extract all. Then run the REG file within that folder. If you are still confused, read this article showing you how to unzip files.

• Option 2: Launch the Registry Editor and make manual edits to the Windows registry

Alternatively, you can open the Registry Editor and navigate to the Windows Defender antivirus using the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

To do this, follow these steps: 

1. Open the Registry Editor by either searching it from the Windows Start Menu, or through the Run box by typing in regedit. 

2. Once you have launched the Registry Editor, navigate to the Windows Defender registry file by following the path above. To do this, click and expand each option, from HKEY_LOCAL_MACHINE, Software, then Policies, then Microsoft, then Windows Defender.

Computer>>HKEY_LOCAL_MACHINE>>SOFTWARE>>Policies>>Microsoft>>Windows Defender

3. If the value DisableAntiSpyware is missing in the right-hand column somewhere under the Default value, right-click anyware in the blank space and hover over New, then left-click on Dword (32-bit) Value. Name it DisableAntiSpyware and press enter.

4. Double click on DisableAntiSpyware and set the Value data to 1.

5. Close the Registry Editor and restart your computer.

Note: To re-enable Microsoft AntiSpyware, set the DisableAntiSpyware value to 0, restart your computer, and you are all set. 

Conclusion

In rare instances, trying to keep Windows Defender from turning itself back on can be challenging.

That’s why we provided a few great methods that include manual settings within the Group Policy editor and the Registry Editor.

It’s my hope that one of these solutions has helped your situation and Windows Defender stays off for good.