Why Does Windows Defender Keep Turning On?

I’ve shared the same frustration. You try disabling Windows Defender, and it keeps turning back on. Windows Defender protects against cyberattacks, malware, and unauthorized data access. However, there are several reasons why you may want to turn it off, including when you have to install an application that clashes with it or save system resources.

In such cases, turning Defender off can be challenging because it may frequently turn on automatically for various reasons. 

How To Keep Windows Defender Turned Off

One of the common issues that Windows users have, especially in Windows 10 and 11, is the real-time protection turning on by itself, even when you have turned off real-time protection. 

Here are some of the reasons why this happens: 

1. Windows Defender is the default anti-malware program

Windows Defender is the default anti-malware program for Windows devices. It is also the default application for cloud-based protection and submissions.

Therefore, it’s usually set to “on” by default.

Since its default setting is set to “on”, Windows Defender may automatically turn itself on when your computer is idle, or there is an external malware threat. 

2. Expired or Lack of an antivirus program

One of the common reasons Windows Defender turns itself on is to provide real-time protection when you don’t have an antivirus program installed or when your antivirus program expires.

Microsoft Support explains that Defender is designed to protect your computer against malware and other threats. 

So if you do not have an antivirus program installed on your computer, Windows Defender will automatically turn on even if you have turned off real-time protection. 

This may also happen if you uninstall your antivirus program or when your antivirus program expires, which means your computer is unprotected against threats.

However, Microsoft Defender should automatically disable itself after installing a third-party program. 

3. Recent Microsoft updates

Microsoft periodically sends out updates that affect various registry components, some of which relate to real-time protection.

If you have installed recent Windows 10 and above updates or set automatic updates on, chances are that Defender is automatically turning itself on due to these updates. 

CERN explains that since Defender is managed centrally on your computer, most virus definition updates are applied without requiring any reboot. 

For instance, updates to Windows 10 prevent Defender from turning itself off after installing an antivirus program.

An excellent example of such updates are updates related to tamper protection. 

Such updates can prevent Defender from automatically turning off after installing another antivirus software.

So even if you turn real-time protection on, it will still turn on automatically due to this tamper protection feature. 

We’ll discuss this further shortly. 

4. Tamper Protection is turned on

One of the key components of Microsoft Defender is tamper protection.

The tamper protection feature in Windows security protects your computer against external intrusion or any cyber attacks directed at whatever antivirus program you have installed. 

Even if you have an antivirus program installed, Defender might automatically turn on when it detects an attempt to install malware or access data on your computer. 

Tamper protection is on by default and is available for most devices running Windows 10 or higher.

As such, any effort to permanently disable or change the security settings in Windows 10 devices and higher may require you first to turn off tamper protection. 

The above is because even if you turn real-time protection off or disable the Defender Firewall without first disabling tamper protection, chances are that it will automatically turn on. 

Deciding whether to turn Defender off or leave it on

While Windows Defender has numerous attractive features to protect your computer against malware threats and data breaches, its downsides include taking up a substantial amount of disk space while consuming many system resources. 

Additionally, if you already have an antivirus program installed, you do not need the extra strain on resources from having Microsoft Defender on and running in the background.

On the same front, Windows Defender may prevent you from installing a third-party antivirus or other software that it detects as malware, much to your inconvenience. 

You may therefore need to either momentarily or permanently turn off Defender. 

However, you’ll want to ensure that you have a reliable antivirus program before turning off Windows Defender.

As explained by Microsoft Support, turning off these protections potentially makes your computer or network more vulnerable to attacks. 

How to permanently turn Defender off: Simple hacks

If you turn off Windows Defender and later realize that it is still running, the good news is that it is possible to turn it off permanently, as will be discussed shortly. 

Before taking advanced steps to turn off Defender, try these basic troubleshooting approaches to turn this antivirus program off in Windows 10 and 11. 

How to turn off Defender on Windows 10   

 Follow the following steps to turn off Defender on Windows 10: 

  1. Click on the Windows Start button, which should be at the bottom left-hand side of your screen to open the Start Menu. 
  2. Go to the Settings icon and click on it. 
How to open the Settings app.
  1. Under the Settings window, click on Update & Security. This should be the last option in that window.
Select Update & Security.
  1. After clicking on Update & Security, click on the Windows Security tab. 
  2. There will be several options under protection areas. Click on Firewall & Network Protection.
Open Firewall & network protection.
  1. You will see three main options in the new window: Domain network, Private network, and Public network. Switch the settings off by clicking on each one and toggling them off
Select all three network firewall settings and toggle them off.
  1. Navigate to Virus and Threat Protection and click on Manage Settings
Select Virus & threat protection and open Manage settings.
  1. Turn off Tamper Protection and Real-time protection
Toggle off Real-time and Tamper protection.

Note: If you are connected to a network, you may be unable to complete these steps. I recommend that you contact your network administrator in such instances. 

How to turn off Windows Defender on Windows 11

To turn Defender off in Windows 11, follow the following simple steps: 

  1. Click on the Windows Start button, and then navigate the Settings icon. 
How to open the Settings app in Windows 11.
  1. Select Privacy & Security in the left column, then Windows Security.
How to open Windows Security settings.
  1. Select Firewall & network protection
How to access Firewall & network protection settings.
  1. Like in Windows 10, you will get the same three network options: Domain, Private, and Public
How to disable all three network firewalls in Windows 11.
  1. Toggle it off under Microsoft Defender Firewall, depending on your network
Domain firewall is toggled off.
  1. Navigate to Virus & threat protection and click on Manage settings
How to select Virus & threat protection and then the Manage settings link.
  1. Turn off Tamper Protection and Real-time protection.
How to turn off protection for Real-time and Tamper Protection in Windows 11.

As with Windows 10, you might be unable to make these changes if you are connected to a network due to applicable network policy settings. You should contact your network administrator. 

Within the Windows Security window, you can also adjust or manage other settings related to cybersecurity protection, tamper protection, and more.

How to permanently turn Windows Defender off: Advanced hacks

Because of security updates, simply turning off Defender in your computer’s panel may not suffice.

If you follow the above steps and it continues to turn itself on, consider these two alternatives:

  • Turn Off Microsoft Defender using Group Policy 
  • Turn Off Microsoft Defender Using a REG file 

Note: You can make edits to the Group Policy and the Registry to disable Microsoft Defender via these two options for both Windows 10 and 11.

Let’s discuss each option in detail below.

Turning off Microsoft Defender using Group Policy 

Group policy is a Windows feature that offers access to various advanced settings, giving you more control over the computer’s working environment. Under group policy, you can configure or manage applications, user settings, and operating systems. 

Use the Local Group Policy editor to access the Windows Group Policy feature.

While this editor is only available in select operating systems (including Windows 10 Enterprise, Pro, and Education editions), you may still be able to access it through the Run box by typing in gpedit.msc

If you cannot access the Group Policy editor through the Run box when not running these Windows versions, I recommend using the REG file option instead. 

To turn off Defender using Group Policy, follow the following simple steps: 

Step 1: Set the Defender Antivirus Tamper Protection to Off

Before changing the Group Policy or Registry data, disabling tamper protection is the first critical step. To disable it: 

  1. Click on the Windows Start button and navigate to Windows Security (Alternatively, type in security in the search box), as shown in the image below. 
How to open the Windows Security app.
  1. Under Windows Security, click on the Virus & Protection icon. This is the first icon, as shown in the image below. 
How to open Virus & threat protection and Manage settings link.
  1. Under Virus & Threat protection, click on Manage Settings. Tamper Protection should be turned on by default. Click on Tamper Protection and set it to off. 
How to toggle Tamper Protection off.

Step 2: Launch the Group Policy Editor

  1. To open the group policy editor, you can search for the Group Policy Editor from the Start Menu or Control Panel
How to open the Group Policy Editor.
  1. In this Group Policy Editor, click on Computer Configuration
How to open Computer Configuration navigation tree.
  1. Under computer configuration, navigate to Administrative Templates
How to open Administrative Templates tree.
  1. Click on Windows Components, and navigate to Microsoft Defender Antivirus.
How to open Windows Components tree.
  1. Under Microsoft Defender Antivirus, navigate to the Turn off Windows Defender Antivirus section. 
How to open the turn off Microsoft Defender policy and edit its settings.
  1.  Disable Microsoft Defender.
Select enabled to disable Microsoft Defender Antivirus.
  1. Close the Group Policy Editor once you are done.

Note: If you want to reactivate Defender, you can simply click on Disabled after following the same steps. 

To make navigation more straightforward, you can follow this path in the Group Policy Editor: 

Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus

If the above process doesn’t cut it, you can turn off Windows Defender using a REG file as discussed below. 

Turning off Microsoft Defender using a REG file

REG files contain one or more registry entries. They are basically text-based files that you can import or export to the Registry using a given syntax. 

To switch off Windows Defender using these REG files, follow these steps: 

Step 1: Turn Off Tamper Protection

The first step is to turn off Windows tamper protection, making it possible to turn off Microsoft Defender antivirus.

Remember, you can’t change the values if tamper protection is on because this feature protects the same security settings you want to change.

Repeat the steps discussed in the previous option to turn off tamper protection. 

Step 2: Install  REG File To Turn Microsoft Defender Antivirus Off

The next step is to install the REG files that turn Microsoft Defender Antivirus files off. There are two options in which you can do this. 

  • Option 1: Download the REG file from a reliable source

In this option, you only need to download the REG files from a reliable source and double-click on the download file. The image below shows that REG files are executable, so Windows will need permission to run this file.

Select Run on unknown publisher file security warning.

The next step is to click on RUN, and the file will change the registry, Turning Windows Defender off. 

After downloading the file, right-click on the Zip file and select Extract all. Then run the REG file within that folder.

  • Option 2: Launch the Registry Editor and make manual edits to the Windows registry

Alternatively, you can open the Registry Editor and navigate to the Windows Defender antivirus using the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

To do this, follow these steps: 

  1. Open the Registry Editor by searching it from the Windows Start Menu or through the Run box by typing in regedit
How to open the Registry Editor.
  1. Once you have launched the Registry Editor, navigate to the Windows Defender registry file by following the path above. To do this, click and expand each option from HKEY_LOCAL_MACHINE, Software, Policies, Microsoft, then Windows Defender.
Select the Windows Defender folder in the Registry Editor.
Computer>>HKEY_LOCAL_MACHINE>>SOFTWARE>>Policies>>Microsoft>>Windows Defender
  1. If the value DisableAntiSpyware is missing under the Default value in the right-hand column, right-click anywhere in the blank space, hover over New, then left-click on Dword (32-bit) Value. Name it DisableAntiSpyware and press enter.
Hot to create a new DWORD 32-bit value.
How to rename the newly created DWORD value.
  1. Double click on DisableAntiSpyware and set the Value data to 1.
How to set the value of the newly created DWORD entry.
  1. Close the Registry Editor and restart your computer.

Note: To re-enable Microsoft AntiSpyware, set the DisableAntiSpyware value to 0, restart your computer, and you are all set.