To temporarily disable Microsoft Defender Antivirus in Windows 11 or Windows 10, open Windows Security, go to Virus & threat protection > Manage settings, and switch Real-time protection off. Use the setting only for the specific task that requires it, then turn it back on as soon as you finish. Microsoft says the control is temporary and may turn itself on again after a short while, but it does not specify an exact number of minutes.
While it is off, files you open or download are not checked in real time. If you need to permit one known file, folder, or process, an exclusion is usually narrower than disabling protection for the whole device.
As an Amazon Associate I earn from qualifying purchases.
What disabling antivirus actually changes
Microsoft Defender Antivirus is built into Windows 10 and Windows 11. The Real-time protection switch controls continuous checking as files are opened, downloaded, or accessed. It does not mean that every Windows security feature disappears, but it removes an important layer of malware protection for the period it is disabled.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Microsoft states: “While real-time protection is off, files you open or download won’t be scanned for threats.” Scheduled scans can continue, but a newly downloaded or installed file may not be checked until the next scheduled scan. Microsoft also warns that your device is vulnerable to malware if Defender is disabled and no other security product is protecting it. Read the current guidance in Microsoft’s Windows Security protection guide and its antivirus FAQ.
#1 Best Overall
Therefore, disable the control only when you have a specific, short-lived reason, such as testing a known application that conflicts with scanning. Do not leave it off while browsing, downloading unknown files, or installing unrelated software.
How to turn off real-time protection in Windows 11 or 10
- Open Windows Security. Select Start, type Windows Security, and open the app.
- Open the antivirus page. Select Virus & threat protection.
- Open the settings. Under Virus & threat protection settings, select Manage settings.
- Switch off real-time scanning. Turn Real-time protection off. Approve a User Account Control prompt if Windows displays one.
- Perform only the required task. Keep the exposure period as short as possible. Do not download or open unrelated files while protection is disabled.
- Restore protection. Return to Windows Security > Virus & threat protection > Manage settings and switch Real-time protection on when the task is complete. If Windows has already restored it automatically, the switch will show that it is on.
The labels above are Microsoft’s published navigation path for Windows 10 and Windows 11. Device configuration, Windows edition, organizational policy, or another security provider can change which controls are available.
How long does the switch stay off?
Microsoft describes Real-time protection as a temporary setting that turns on automatically after a short while. Microsoft does not publish a fixed duration, so do not rely on a promise such as 10, 15, or 30 minutes. The safe practice is to turn it on yourself immediately after the task and verify the status in Windows Security.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the switch has reverted before you finish, that is expected behavior rather than proof that Windows is malfunctioning. Complete the task in smaller steps, or use a targeted exclusion if the same known file or process repeatedly triggers the conflict.
Why can’t I turn off real-time protection?
Tamper Protection is blocking the change
Microsoft says Tamper Protection can prevent changes to Real-time protection. In Windows Security, open Virus & threat protection > Manage settings and check the Tamper Protection control. If your account and device policy allow it, turn Tamper Protection off temporarily, change Real-time protection, and restore Tamper Protection afterward. Microsoft documents this relationship in Virus and Threat Protection in the Windows Security app.
Your organization manages the device
On a work, school, or otherwise managed computer, an administrator may enforce antivirus settings. A missing, greyed-out, or immediately reverting control can indicate policy management. Do not assume that registry edits or command-line workarounds will override that policy. Contact the device administrator or follow the organization’s current Microsoft guidance.
Another antivirus is active
Compatible non-Microsoft antivirus software can put Defender into a disabled mode automatically. Conversely, Defender can turn itself on when another security product is absent or its subscription has expired. Check the provider shown in Windows Security rather than assuming which product is currently protecting the computer. Microsoft explains the automatic operating-mode changes in its antivirus and antimalware FAQ.
Use an exclusion when only one item is the problem
If you know the exact file, folder, file type, or process causing a false positive or compatibility problem, Microsoft says an exclusion is safer than switching off all Real-time protection. An exclusion narrows the exception, but it still reduces scanning and introduces risk. Treat excluded content as trusted only after checking its origin and integrity.
What Windows Security can exclude
- File: one specific file is omitted from Defender’s Real-time scanning.
- Folder: files in the selected folder are omitted from Real-time scanning.
- File type: files with the selected extension are omitted, which can affect many files and therefore needs extra caution.
- Process: files opened by the selected process can be excluded. Microsoft recommends entering the process’s full path and filename rather than relying on a broad process name.
How to add an exclusion
- Open Windows Security from Start.
- Select Virus & threat protection, then Manage settings.
- Scroll to Exclusions and select Add or remove exclusions.
- Choose Add an exclusion, select File, Folder, File type, or Process, and select or enter the item.
- Remove the exclusion when the task or troubleshooting session is over.
Exclusions do not necessarily remove an item from every type of scan. Microsoft notes that scheduled scans and scans performed by third-party antimalware may still apply. The Microsoft page on exclusions and Tamper Protection is available at Virus and Threat Protection in the Windows Security app.
Real-time protection versus an exclusion
| Choice | Scope of reduced protection | What happens to scheduled scans | When it fits |
|---|---|---|---|
| Turn off Real-time protection | Files opened or downloaded are not scanned in real time while the switch is off. | Scheduled scans can continue; a file may wait until the next scheduled scan for detection. | A short, controlled task that genuinely cannot run with real-time scanning enabled. |
| Add an exclusion | Only the selected file, folder, file type, or process-related files are excluded from Defender Real-time scanning. | Microsoft says exclusions do not necessarily exempt items from scheduled scans or scans by third-party antimalware. | A known, specific item repeatedly blocked or misidentified by Defender. |
The exclusion option is narrower, not risk-free. A folder or file-type exclusion can cover more data than intended, and a process exclusion can cover files that process opens. Review the path carefully and delete the exception when it is no longer needed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check which protection is active
Windows can change Defender’s operating mode when compatible third-party antivirus is installed, removed, or expires. Before disabling anything, open Windows Security and identify the provider shown on the protection page. If another product is active, disabling Defender may not remove all antivirus scanning, but you should still follow that provider’s controls and documentation rather than assuming coverage.
Recommended Free Tools
Microsoft’s guidance does not establish that every third-party product behaves identically. Compatibility and management settings vary, so verify the active provider on the device itself. You can find Microsoft’s instructions for scanning an item and understanding provider behavior at Scan an item with Windows Security.
Best Value
After you finish: restore and verify protection
- Return to Windows Security > Virus & threat protection > Manage settings.
- Confirm Real-time protection is on. If you changed Tamper Protection, restore its intended setting too.
- If you added an exclusion, open Add or remove exclusions and remove it.
- For a downloaded or modified file, right-click it in File Explorer and use the Windows Security scan command when available, or start a scan from Windows Security.
- Check the protection provider shown in Windows Security, especially if another antivirus was installed, removed, or expired during troubleshooting.
Turning Real-time protection back on restores continuous scanning, but it does not make an earlier unsafe download safe. Scan the relevant item and delete anything you cannot verify.
Common mistakes to avoid
- Assuming the switch disables every security feature: it specifically changes Defender Real-time protection; other Windows security controls may remain active.
- Leaving it off while searching for a solution: browsing and downloading during the unprotected interval increases exposure.
- Expecting a fixed timeout: Microsoft only says “after a short while,” without a guaranteed duration.
- Using a broad exclusion for convenience: excluding an entire drive, common download folder, or file type can hide threats across many files.
- Forcing changes on a managed computer: administrator policy may control the setting, and unsupported workarounds can violate organizational rules.
- Forgetting another provider: Defender’s status can change when compatible third-party antivirus is installed or expires; verify the active provider instead of guessing.
When disabling Defender is not appropriate
Do not disable protection merely to make an unknown download, crack, attachment, or script run. If a file is unexpected, obtain it from the publisher again, verify its source, and scan it. If a legitimate application is blocked, first check whether an item-level exclusion or an update to the application resolves the problem. If you cannot identify why protection is being triggered, keep Defender enabled and seek help from the software publisher or your administrator.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
