Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows 11 / How to Permanently Disable Microsoft Defender Antivirus on Windows 11 and 10

June 8, 2023

How to Permanently Disable Microsoft Defender Antivirus on Windows 11 and 10

Microsoft Defender is the built-in antivirus program on Windows 10/11 and Windows Server that is enabled and configured by default. In this article, we’ll look at how to turn off Microsoft Defender on Windows 11 completely or suspend it.

When you install a third-party antivirus in Windows 10 or 11, the built-in Microsoft Defender Antivirus is automatically disabled. In some cases, it doesn’t happen and you may need to disable Microsoft Defender manually.

Contents:
  • Turn off Defender Antivirus Protection on Windows 11 and 10
  • How to Disable Microsoft Defender Antivirus in Windows 11 Permanently?

Turn off Defender Antivirus Protection on Windows 11 and 10

In some cases, you may need to suspend Microsoft Defender Antivirus protection without affecting important system services. For example, when Microsoft Defender prevents a system program or tool from running or installing. To run such an app, you have to stop Windows Defender Real-time Protection.

  1. Open Settings -> Privacy and Security -> Windows Security  (or run a quick access URI command: ms-settings:windowsdefender ) in Windows 11;
    If the Microsoft Defender Security app doesn’t open or shows a blank screen, you can fix it by reinstalling Microsoft.SecHealthUI UWP app.
  2. Open Virus and threat protection and click Manage Settings; Virus and threat protection on Windows 11
  3. Move the Real-time protection toggle to Off. Disable Real-time protection in Microsoft Defender
  4. Confirm that you want to stop antivirus protection in the UAC prompt.

To resume Windows Defender protection, move the toggle to On. Also, Microsoft Defender Real-time Protection is enabled automatically after you restart the computer.

You can use the following PowerShell command to disable real-time protection (see how to manage Windows Defender settings using PowerShell):

Set-MpPreference -DisableRealtimeMonitoring $true

However, this command doesn’t work as expected in Windows 11 and the latest Windows 10 builds. The matter is that in Windows 10 1903 or later, a new Microsoft Defender feature is enabled by default: Microsoft Defender Tamper Protection.

Tamper protection provides additional protection for core Microsoft Defender security features. In particular, it prevents unauthorized changes of antivirus settings, suspension of real-time protection, and disabling of cloud protection. If the Tamper Protection is enabled, you won’t be able to disable Real-Time Protection in Microsoft Defender using PowerShell.

You can only disable Tamper Protection manually from Windows Security GUI. Navigate to Virus and threat protection section, scroll down and switch the Tamper Protection toggle to Off.

Protect Microsoft Defender security settings with tamper protection

After disabling Tamper Protection, you will be able to disable Microsoft Defender Real-time Protection using the PowerShell command shown above.

How to Disable Microsoft Defender Antivirus in Windows 11 Permanently?

In earlier Windows 10 builds and in Windows Server 2016, you could completely disable Windows Defender using the Turn off Windows Defender Antivirus GPO option located in Computer Configurations -> Administrative Template -> Windows Component -> Windows Defender Antivirus section of the Local Group Policy Editor (gpedit.msc) or using the DisableAntiSpyware registry parameter under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender:

New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force

Turn off Windows Defender Antivirus using GPO

Also, you can disable Real-Time Protection using the GPO option Turn on behavior monitoring or with the registry parameter DisableBehaviorMonitoring =1.

Starting from Windows 10 1903 release, you cannot use these GPO options or registry parameters to disable Microsoft Defender, because these settings are shielded by Tamper Protection. The methods previously used to disable Microsoft Defender Antivirus don’t work on Windows 11.

To completely disable Windows Defender Antivirus on Windows 11, you need to boot your computer to Safe Mode.

  1. Run msconfig;
  2. Go to the Boot tab;
  3. Select Safe boot -> Minimal in the boot options section;
  4. Click OK and restart your computer. msconfig - enable safe boot
  5. Your computer will boot into Safe Mode;
  6. Then open the Registry Editor (regedit.exe), go to the reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and disable the startup of the following services:
    • Sense
    • WdBoot
    • WdFilter
    • WdNisDrv
    • WdNisSvc
    • WinDefend

    To do it, change the Start parameter value to 4. disable windefend service via registry

    Change the Start value for all services specified above manually or using the following PowerShell script:
    $regpath='HKLM:\SYSTEM\CurrentControlSet\Services'
    Set-ItemProperty -Path ($regpath+"\WinDefend") -Name Start -Value 4
    Set-ItemProperty -Path ($regpath+"\Sense") -Name Start -Value 4
    Set-ItemProperty -Path ($regpath+"\WdFilter") -Name Start -Value 4
    Set-ItemProperty -Path ($regpath+"\WdNisDrv") -Name Start -Value 4
    Set-ItemProperty -Path ($regpath+"\WdNisSvc”) -Name Start -Value 4
    Set-ItemProperty -Path ($regpath+"\WdBoot") -Name Start -Value 4

    To re-enable Microsoft Defender in Windows, set the following default values of the Start registry entry for services:

    • Sense — 3
    • WdBoot — 0
    • WdFilter — 0
    • WdNisDrv — 3
    • WdNisSvc — 3
    • WinDefend — 2
  7. Run msconfig and disable the Safe Mode. Then restart your computer and boot as usual;
  8. Disable the following four tasks in Task Scheduler (taskschd.msc): Microsoft –> Windows –> Windows Defender. Disable Windows Defender tasks in Task Scheduler
    Get-ScheduledTask “Windows Defender Cache Maintenance” | Disable-ScheduledTask
    Get-ScheduledTask “Windows Defender Cleanup” | Disable-ScheduledTask
    Get-ScheduledTask “Windows Defender Scheduled Scan” | Disable-ScheduledTask
    Get-ScheduledTask “Windows Defender Verification” | Disable-ScheduledTask
You can disable the Scheduler tasks using PowerShell.

Run the Windows Security app and make sure that Microsoft Defender Antivirus is now disabled. You should see the message: Threat service has stopped. Restart it now. Microsoft Defender - Threat service has stopped. Restart it now

So we have looked at how to disable Microsoft Defender Antivirus on Windows 10 and 11.

16 comments
12
Facebook Twitter Google + Pinterest
Windows 10Windows 11
previous post
Configure SSH Tunnel (Port Forwarding) on Windows
next post
Granting Send As and Send on Behalf Permissions in Exchange Server/Microsoft 365

Related Reading

How to Repair EFI/GPT Bootloader on Windows 10...

March 16, 2024

How to Restore Deleted EFI System Partition in...

March 11, 2024

How to Allow Multiple RDP Sessions on Windows...

March 15, 2024

How to Run Program without Admin Privileges and...

June 8, 2023

Wi-Fi (Internet) Disconnects After Sleep or Hibernation on...

March 15, 2024

How to Install Remote Server Administration Tools (RSAT)...

March 17, 2024

How to Repair Windows Boot Manager, BCD and...

March 11, 2024

Network Computers are not Showing Up in Windows...

March 15, 2024

16 comments

Raz January 30, 2023 - 6:18 pm

Hey, thanks a lot for this article!
I’ve finally managed to completely disable defender antivirus in Windows 11 22H2, i.e. following your instructions.
Have been fighting to achieve that goal for some time, unsuccessfully (except for blocking (in safe mode) the MsMpEng.exe via IFEO; which is hardly elegant:
reg add “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe” /v Debugger /t REG_SZ /d “C:\windows\system32\cmd.exe /c exit 0″).
—
Only one thing: in the PowerShell script you’ve omitted one line:
Set-ItemProperty -Path ($regpath+”\WdBoot”) -Name Start -Value 4
**
with best wishes for the new year!

Reply
admin February 10, 2023 - 10:49 am

thanks!

Reply
Brian February 13, 2023 - 3:54 pm

Hey. This really worked! Very happy. I’m still on 10 but seeing how this works for both 10/11.
Thank you.

Reply
best9bg February 23, 2023 - 8:31 am

Cant find “Sense” on regedit on Windows 11 Home

Reply
admin February 28, 2023 - 12:24 pm

The “Sense” service is responsible for providing insights and recommendations to users regarding Windows security and device performance. The service monitors system behaviors and reports any abnormal activities to Microsoftcloud-based security service for analysis. Perhaps it’s missing from Windows 11 Home.

Reply
Marek Sedlář March 11, 2023 - 3:20 pm

Hello and thanks for the tips.
Unfortunately, whenever I apply all the steps, applications stop running, or start like 30-60 seconds later.
Not sure what exact command always broke it. Thankfully reverse commands fix the issue.

Reply
ali bigi March 30, 2023 - 4:11 pm

Thank you soooooooooooooooo much!
and fck Microsoft

Reply
Enrique Perez April 25, 2023 - 10:17 pm

Thanks so much! the windows defender antimalware service was eating ram ,disk and cpu usage . Not it cant do any more . thanks a lot

Reply
Onur May 2, 2023 - 9:30 am

I did this solution Windows 10 Home and Pro PC. “Sense” is missing in Home version. However, disabling the others still works. Thanks.

Reply
Charles Woods July 1, 2023 - 4:23 pm

Hie,
After following all the steps there is a “Getting protection info…” notification under Virus and Threat Protection. How can I solve this because the computer still isn’t installing apps from unknown sources.
Also, there was no ‘Windows Defender Scheduled Scan’ in the Tasks Scheduler.
Thanks

Reply
Hector July 2, 2023 - 6:51 pm

After many hours of having the same problem as you with windows 11 home, as programs were starting realle delayed and some could even not start, I foud the solution.

To have it fixed, apart from disabling whose services with msconfig in safe boot, (my windows is in Spanish so some texts may be different as I just thrnslated directly) you need to open “windows security”, then go to “Applications and browser security”, and finally under “Intelligent application control” click to configure, and then in the next screen on “disable”. This solved the problem for me in windows 11 home

Reply
Charles Woods July 2, 2023 - 10:38 pm

Thanks Hector for the assistance 🙂
Unfortunately I’m using Windows 10 Pro, version 22H2 with no ‘Intelligent Application Control’ feature.
Thanks again anyways.

Reply
mirroreduser January 7, 2024 - 9:55 pm

Thank you brother. So far, it’s working. After a few hours, Defender didn’t activate it self.

Reply
Wag January 27, 2024 - 6:08 am

Thank you very much. For Windows 11 there is no Sense Service so you can just ignore it.

Reply
Sergio February 21, 2024 - 10:03 am

Why is Microsoft not giving the option to make your own choice of what is a virus and what is not?

My previous programs were installed were purchased software and freeware and now Microsoft is removing these programs which are not virus and not having control over your system. It seems that if your not downloading software exe launchers are classified as a virus

Is there a log of what Windows defender has removed?

Reply
Jeff K. July 9, 2024 - 5:43 am

Thank you so much for this guide! Windows Security went rogue and stopped letting me customise it, and it was blocking a lot of things even though I had a real antivirus installed (Kaspersky). Every other guide I found was way too basic or asked me to change settings I couldn’t access – this helped me get it to shut up for good. THANKS!

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • How to Allow Multiple RDP Sessions on Windows 10 and 11
  • How to Repair EFI/GPT Bootloader on Windows 10 or 11
  • How to Restore Deleted EFI System Partition in Windows
  • Network Computers are not Showing Up in Windows 10/11
  • How to Run Program without Admin Privileges and Bypass UAC Prompt
  • Fix: BSOD Error 0x0000007B (INACCESSABLE_BOOT_DEVICE) on Windows
  • Install and Manage Windows Updates with PowerShell (PSWindowsUpdate)
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top