How to Turn Windows Defender On or Off

Microsoft Defender is on by default and, for most people, it is genuinely enough. The reasons to touch any of these settings are narrow: a false positive on a file you know is fine, a build tool being ground to a halt by real-time scanning, or installing a different antivirus. Every one of those has a proper answer, and turning the whole thing off is not it.

Turning Defender on

Turning it off, and why it comes back

The same toggle switches real-time protection off. Windows will complain, and then it will quietly switch it back on again, either after a while or at the next restart. This is not a bug and you cannot out-stubborn it.

This is designed behaviour rather than a bug. The toggle exists for a short diagnostic window: install something whose installer is being wrongly blocked, confirm a suspicion, then let protection resume. Microsoft's position is that a consumer machine should not sit indefinitely with no real-time scanner, and the product enforces that.

Tamper Protection, and the methods it closed

Tamper Protection stops anything other than the Windows Security app itself from changing Defender's settings. It exists for a good reason: disabling the antivirus is one of the very first things malware tries. If a script or registry tweak you found online is not sticking, this is usually why, and that is the feature working correctly.

Its practical consequence is that a great deal of older advice no longer works. Setting DisableAntiSpyware in the registry, using Group Policy to turn Defender off, and PowerShell's Set-MpPreference -DisableRealtimeMonitoring $true are all blocked while Tamper Protection is on. Guides recommending them were written before it shipped.

You can turn Tamper Protection off, under the same Manage settings page, and it requires an administrator. Think carefully first: it is a cheap, effective protection against a specific and common attack, and turning it off to silence one false positive is a poor trade when an exclusion would do.

Exclusions: usually what you actually want

An exclusion tells Defender to skip one specific file, folder, file type or process. It survives restarts, applies only where you point it, and leaves protection intact everywhere else. This is the right tool both for a false positive and for a build folder that real-time scanning is slowing to a crawl.

For development machines, the exclusions worth considering are a specific build output folder, and the compiler or build tool as a process exclusion — that skips scanning of files the tool touches while leaving everything else covered.

Installing a different antivirus

You do not need to turn Defender off first, and I would not. When another product registers itself with the Windows Security Center, Defender stands down its own real-time protection automatically. Two real-time scanners running together is a real problem: they inspect each other's file access, which causes both slowdowns and false positives.

Whether you need a third-party product is a separate question. Independent testing has placed Defender's detection rates alongside commercial products for several years, it is included, and it does not attempt to sell you anything from a notification. The honest answer for most home users is that the built-in option is sufficient.

Running a scan

Under Virus & threat protection, Quick scan checks the places malware usually lives and takes a few minutes. Scan options adds a Full scan of every file, and Microsoft Defender Antivirus (offline scan), which restarts the machine and scans before Windows loads. That last one is the tool for anything you genuinely suspect, because it runs before the malware gets a chance to.

The offline scan is the one worth knowing about. Some malware is difficult to remove while Windows is running because it is running too. Scanning before the operating system starts removes that advantage, and it is the right first response to a machine you genuinely suspect is infected.

One thing this guide will not cover: turning Defender off permanently on a machine you use normally. There is no supported way to do it, the unsupported routes are closed by Tamper Protection, and the reason both of those things are true is a good one. If a specific file or folder is the problem, exclude it. If you prefer a different product, install it and let Windows stand Defender down. Related settings live in the guides on turning off the Windows firewall and changing your Windows password and PIN.