Turn On or Off Real-time Protection for Microsoft Defender Antivirus  

Page 1 of 12 12311 ... LastLast
    Turn On or Off Real-time Protection for Microsoft Defender Antivirus

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus

    How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 10
    Published by Category: Security System
    02 Feb 2021
    Designer Media Ltd


    How to Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 10


    Starting with Windows 10 version 2004, Windows Defender Antivirus as been renamed to Microsoft Defender Antivirus.

    Windows 10 includes Windows Security, which provides the latest antivirus protection. Your device will be actively protected from the moment you start Windows 10. Windows Security continually scans for malware (malicious software), viruses, and security threats. In addition to this real-time protection, updates are downloaded automatically to help keep your device safe and protect it from threats.

    Microsoft Defender Antivirus is the next-generation protection component of Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP). Next-generation protection brings together machine learning, big-data analysis, in-depth threat resistance research, and the Microsoft cloud infrastructure to protect devices in your enterprise organization. Next-generation protection services include the following:


    Microsoft Defender Antivirus helps protect your PC against malware (malicious software) like viruses, spyware, and other potentially unwanted software. Malware can infect your PC without your knowledge: it might install itself from an email message, when you connect to the Internet, or when you install certain apps using a USB flash drive, CD, DVD, or other removable media. Some malware can also be programmed to run at unexpected times, not only when it's installed.

    In Windows 10, you can turn off Microsoft Defender Antivirus real-time protection, but it will only be temporary unless disabled. Windows will automatically turn real-time protection back on if it's off for a while.

    Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.

    These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure.

    See also:

    This tutorial will show you how to turn on or off real-time protection for Microsoft Defender Antivirus for all users in Windows 10.

    You must be signed in as an administrator to turn on or off real-time protection for Microsoft Defender Antivirus.


    When you install some 3rd party antivirus (AV) programs, they may automatically turn off Microsoft Defender Antivirus. In this case you may not be able to turn on Microsoft Defender Antivirus again until the 3rd party AV program has been disabled (turned off) or completely uninstalled.

    If you have a 3rd party AV program installed and disable Microsoft Defender Antivirus, this will also disable periodic scanning.

    If you have Windows 10 build 18305 or higher installed, you will need to turn off Tamper Protection to be able to disable Microsoft Defender Antivirus.



    Contents

    • Option One: Turn Off Real-time Protection for Microsoft Defender Antivirus in Windows Security
    • Option Two: Turn On Real-time Protection for Microsoft Defender Antivirus in Windows Security
    • Option Three: Turn On or Off Real-time Protection for Microsoft Defender Antivirus in PowerShell
    • Option Four: Turn On or Off Real-time Protection for Microsoft Defender Antivirus in Command Prompt
    • Option Five: Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Group Policy
    • Option Six: Enable or Disable Real-time Protection for Microsoft Defender Antivirus using a REG file



    EXAMPLE: Real-time Protection for Microsoft Defender Antivirus disabled
    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-windows_defender_real-time_protection-off.png





    OPTION ONE

    Turn Off Real-time Protection for Microsoft Defender Antivirus in Windows Security


    If you use this option to turn off real-time protection for Microsoft Defender Antivirus, it will only be temporary. When it's off for a while, Windows will turn it back on automatically.

    Option Five and Option Six below will override this option.


    1 Open Windows Security, and click/tap on the Virus & threat protection icon. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_off_windows_defender_real-time_protection-1.jpg

    2 Click/tap on the Manage settings link under Virus & threat protection settings. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_off_windows_defender_real-time_protection-2.png

    3 Turn off Real-time Protection. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_off_windows_defender_real-time_protection-3.png

    4 Click/tap on Yes when prompted by UAC.

    5 You can now close Windows Security if you like.






    OPTION TWO

    Turn On Real-time Protection for Microsoft Defender Antivirus in Windows Security


    This is the default setting.

    Option Five and Option Six below will override this option.


    1 Open Windows Security.

    2 Do step 3 or step 4 below for how you would like to turn on Windows Defender Real-time protection.

    3 Click/tap on the Turn on button under the Virus & threat protection icon, and go to step 5 below. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_on_windows_defender_real-time_protection-1.jpg

    4 Click/tap on the Virus & threat protection icon. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_on_windows_defender_real-time_protection-2.jpg

    A) Click/tap on the Manage settings link under Virus & threat protection settings. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_on_windows_defender_real-time_protection-3.png

    B) Turn on Real-time Protection, and go to step 5 below. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_on_windows_defender_real-time_protection-4.png

    5 Click/tap on Yes when prompted by UAC.

    6 You can now close Windows Security if you like.






    OPTION THREE

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus in PowerShell


    If you use this option to turn off real-time protection for Microsoft Defender Antivirus, it will only be temporary. When it's off for a while, Windows will turn it back on automatically.

    Option Five and Option Six below will override this option.


    1 Open an elevated PowerShell.

    2 Enter the command below you want to use into PowerShell, and press Enter. (see screenshots below)

    (Turn on)
    Set-MpPreference -DisableRealtimeMonitoring 0
    or
    Set-MpPreference -DisableRealtimeMonitoring $false

    OR

    (Turn off)
    Set-MpPreference -DisableRealtimeMonitoring 1
    or
    Set-MpPreference -DisableRealtimeMonitoring $true

    3 When finished, you can close PowerShell if you like.

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_on_windows_defender_real-time_protection_powershell.png
    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-turn_off_windows_defender_real-time_protection_powershell.png






    OPTION FOUR

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus in Command Prompt


    If you use this option to turn off real-time protection for Microsoft Defender Antivirus, it will only be temporary. When it's off for a while, Windows will turn it back on automatically.

    Option Five and Option Six below will override this option.


    1 Open an elevated command prompt.

    2 Enter the command below you want to use into the elevated command prompt, and press Enter.

    (Turn on)
    PowerShell Set-MpPreference -DisableRealtimeMonitoring 0
    or
    PowerShell Set-MpPreference -DisableRealtimeMonitoring $false

    OR

    (Turn off)
    PowerShell Set-MpPreference -DisableRealtimeMonitoring 1
    or
    PowerShell Set-MpPreference -DisableRealtimeMonitoring $true

    3 When finished, you can close the elevated command prompt if you like.






    OPTION FIVE

    Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Group Policy


    The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

    All editions can use Option Six below.

    This option is the same as Option Six below, and will let you disable Windows Defender Real-time Protection without being prompted it is turned off, and without it getting automatically turned back on later by Windows.

    When disabled, you will not be able to do Option One, Option Two, Option Three, or Option Four.


    1 Open the Local Group Policy Editor.

    2 In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

    Computer Configuration/Administrative Templates/Windows Components/Microsoft Defender Antivirus/Real-time Protection

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-windows_defender_gpedit-1.jpg

    3 In the right pane of Real-time Protection in Local Group Policy Editor, double click/tap on the Turn off real-time protection policy to edit it. (see screenshot above)

    4 Do step 5 (enable) or step 6 (disable) below for what you would like to do.


     5. To Enable Real-time Protection for Microsoft Defender Antivirus

    A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

    Not Configured is the default setting.


     6. To Disable Real-time Protection for Microsoft Defender Antivirus

    A) Select (dot) Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

    Turn On or Off Real-time Protection for Microsoft Defender Antivirus-windows_defender_group_policy-2.png

    7 When finished, you can close the Local Group Policy Editor if you like.






    OPTION SIX

    Enable or Disable Real-time Protection for Microsoft Defender Antivirus using a REG file


    This option is the same as Option Five above and will let you disable Windows Defender Real-time Protection without being prompted it is turned off, and without it getting automatically turned back on later by Windows.

    When disabled, you will not be able to do Option One, Option Two, Option Three, or Option Four.

    The downloadable .reg files below will add and modify the DWORD value in the registry key below.

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection

    DisableRealtimeMonitoring DWORD

    (delete) = enable
    1 = disable


    1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.


     2. To Enable Real-time Protection for Microsoft Defender Antivirus

    This is the default setting.

    A) Click/tap on the Download button below to download the file below, and go to step 4 below.

    Enable_Windows_Defender_Real-Time_Protection.reg

    Download


     3. To Disable Real-time Protection for Microsoft Defender Antivirus

    A) Click/tap on the Download button below to download the file below, and go to step 4 below.

    Disable_Windows_Defender_Real-Time_Protection.reg

    Download

    4 Save the .reg file to your desktop.

    5 Double click/tap on the downloaded .reg file to merge it.

    6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

    7 Restart the computer to apply.

    8 If you like, you can now delete the downloaded .reg file.


    That's it,
    Shawn


    Related Tutorials



  1. Brink's Avatar
    Posts : 60,030
    64-bit Windows 11 Pro for Workstations
       #1

    Tutorial updated for Windows 10 Technical Preview build 10074.

    Note   Note
    In Windows 10 Technical Preview build 10074, you can turn off Windows Defender real-time protection temporarily, but it's off for a while, Windows will turn it back on automatically.

      My Computers


  2. Posts : 4
    Windows 10 Pro
       #2

    Brink said:
    Tutorial updated for Windows 10 Technical Preview build 10074.

    Note   Note
    In Windows 10 Technical Preview build 10074, you can turn off Windows Defender real-time protection temporarily, but it's off for a while, Windows will turn it back on automatically.

    You can disable Windows Defender Real-time Protection in Local Group Policy Editor (Run: gpedit.msc then select: Computer Configuration/Administrative Templates/Windows Components/Windows Defender/Real-time Protection and enable the "Turn off Real-time Protection" setting). It won't turn back on automatically and Windows Defender doestn't even notice that there's something wrong (it will stay green).
      My Computer


  3. Posts : 46
    64-bit 10240 10 Pro
       #3

    I use it, WD seems to be adequate.
      My Computer

  4. Brink's Avatar
    Posts : 60,030
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #4

    Majestic12 said:
    You can disable Windows Defender Real-time Protection in Local Group Policy Editor (Run: gpedit.msc then select: Computer Configuration/Administrative Templates/Windows Components/Windows Defender/Real-time Protection and enable the "Turn off Real-time Protection" setting). It won't turn back on automatically and Windows Defender doestn't even notice that there's something wrong (it will stay green).

    You could also use this below to completely disable Windows Defender. :)

    https://www.tenforums.com/tutorials/5...dows-10-a.html
      My Computers


  5. Posts : 4
    Windows 10 Pro
       #5

    Brink said:
    You could also use this below to completely disable Windows Defender. :)

    https://www.tenforums.com/tutorials/5...dows-10-a.html
    I know, but quick antivirus scan can be useful from time to time and furthermore after completely disabling Windows Defender you get that annoying window, informing you that WD is turned off, every time the computer starts.
      My Computer

  6. Brink's Avatar
    Posts : 60,030
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #6

    Agreed. Tutorial updated to add this. :)
    Last edited by Brink; 06 Jul 2015 at 14:33. Reason: update
      My Computers


  7. tazmo8448's Avatar
    Posts : 204
    Windows 10 Pro
       #7

    Using the merge registry to enable WD on the above method, have noticed that while running Emsisoft Emergency Kit (EEK) that the registry created by the utility (Enable_Windows_Defender_Real-Time_Protection.reg) is when EEK is run listed as a (from the log file):

    Scan start: 11/8/2015 10:44:19 PMValue: HKEY_USERS\S-1-5-21-2610782532-1500699501-3633152452-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN -> WINDOWS DEFENDER detected: Backdoor.Win32.BlackShades (A)

    realizing this may be a false/positive curious as to why it would see the registry file as such.
      My Computer

  8. TairikuOkami's Avatar
    Posts : 5,025
    Windows 11 Home
       #8

    tazmo8448 said:
    realizing this may be a false/positive curious as to why it would see the registry file as such.
    Malware usually disables WD , so it sees the key as a threat, does not matter, if it is 1 or 0.
      My Computer

  9. tazmo8448's Avatar
    Posts : 204
    Windows 10 Pro
       #9

    On an upgrade to W10 from W7 the WD icon didn't show so I used the above utility to enable it. Then a little later ran EEK it latched on the registry file the utility created showing it as a BackDoor.BlackShades. Let me make this clear the BackDoor did not show in EEK til I ran the utility. It did not show prior to running the utility. The utility itself creates the registry file that EEK finds as a Trojan. I can remove the reg file and EEK shows nothing I can re-run the utility and EEK will again show it as a Trojan.
    I am aware of the fact that malware likes to disable A/V but this particular issue is caused by triggering the icon to show in the task bar.
      My Computer


 
Page 1 of 12 12311 ... LastLast

Tutorial Categories

Turn On or Off Real-time Protection for Microsoft Defender Antivirus Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 00:49.
Find Us




Windows 10 Forums