Windows Defender (now called Microsoft Defender) is the built-in antivirus protection in every Windows edition. While it is generally recommended to leave it enabled, there are legitimate reasons to turn it off temporarily — most commonly when installing a third-party antivirus like Malwarebytes, Bitdefender, or Avast that conflicts with real-time scanning. If Defender is causing high system load, see the guide on fixing MsMpEng.exe high CPU usage before disabling it outright.
This guide covers the PowerShell method specifically. Disabling requires two steps: turning off Tamper Protection first (which blocks external changes to Defender settings), then running a single PowerShell command. Enterprise administrators have more granular control available through the Local Group Policy Editor.
| Method | Tool Required | Scope | Available On |
|---|---|---|---|
| PowerShell command | PowerShell (admin) | Real-time protection | All editions |
| Windows Security UI | Settings app | Real-time protection | All editions |
| Registry Editor | regedit | Broader Defender settings | All editions |
| Group Policy | gpedit.msc | Full managed control | Pro and Enterprise only |
Step 1 — Disable Tamper Protection in Windows Security
Tamper Protection prevents unauthorized changes to Windows Security settings. It must be turned off before any external tool — including PowerShell — can modify Defender’s real-time monitoring state.
Step 1: Launch Windows Security from the Start menu.
Step 2: Go to Virus & threat protection.
Step 3: Click Manage settings under “Virus & threat protection settings”.
Step 4: Scroll down to Tamper Protection and toggle it to Off. Confirm the UAC prompt if one appears.
Step 2 — Disable Real-Time Protection via PowerShell
With Tamper Protection off, PowerShell can now modify Defender’s real-time monitoring setting. Run PowerShell as an administrator — a standard session will not have the permissions needed.
Step 1: Press Windows + X and select Windows PowerShell (Admin) or Terminal (Admin).
Step 2: Type the following command and press Enter:
Set-MpPreference -DisableRealtimeMonitoring $true
Windows Defender real-time protection is now off. The same command can also be run in an elevated Command Prompt (CMD) if preferred.
How to Re-Enable Windows Defender
To turn real-time protection back on, open PowerShell as an administrator and run:
Set-MpPreference -DisableRealtimeMonitoring $falseAfter running the command, go back into Windows Security and re-enable Tamper Protection to restore full protection. Note that on many Windows versions, Defender will automatically re-enable itself after a reboot even if the command was run successfully — this is by design and is not a sign that the command failed.