Turn On or Off Real-time Protection for Microsoft Defender Antivirus  

Hello @Erjon, and welcome to Ten Forums.

What build and version of Windows 10 do you currently have installed?

KyleK29 said:

Does anyone have the Powershell method working on Windows 10 1903? I had the DisableRealtimeMonitoring working fine on 1809 with shortcuts, but since I've updated to 1903 they no longer toggle. Tested manually with an elevated Powershell terminal and got the same result (they don't change). I need to be able to do it live without restarting.

ExecutionPolicy is set to remotesigned . And the official documents don't note any changes to the cmdlet: https://docs.microsoft.com/en-us/pow...?view=win10-ps

I did notice a user on SuperUser that had to change his scripts to TrustedInstaller level to get them to work ( How to disable Windows Defender via PowerShell on Windows 10 version 1903+? - Super User ). But I'd rather avoid that if there's a workaround.

Hello Kyle, and welcome to Ten Forums.

Do you have Tamper Protection turned on?

If you do, you will only be able to make changes to Windows Defender Antivirus settings from within Windows Security.

Turn On or Off Tamper Protection for Windows Defender Antivirus

KyleK29 said:

Yep, that was it. Thank you very much! I didn't even realize that setting was added.

You're most welcome.

ocitp said:

I thought switching this off fixed it, but Real-Time protection switches itself on again after a while. It may be that Windows recently updating to version 1909 somehow reset my group policy, but 'Turn off real-time protection' is still Enabled as I set it. This is driving me mad. Ideally, I am trying to get Windows Defender not to complain about Real-time AV and Tamper Protection being switched off -- ie no yellow triangle or red X. Any suggestions please?

Hello ocitp, and welcome to Ten Forums.

You could disable notifications from Windows Security to stop these notifications.

Enable or Disable Notifications from Windows Security in Windows 10

ocitp said:

Thanks for the reply. This would disable all notifications, including useful ones, and I believe it wouldn't remove the yellow triangle or X from the tray icon. What I mean is there must (or should ) be a way for an admin to tell Windows that Real-time AV protection being off is absolutely normal.

But anyway, my main problem is that I followed the instructions here and elsewhere, group policy is set properly, yet Real-Time AV switches back on. This has been going on for over a week. Has anyone else had this problem? The next step will probably have to be something drastic involving disabling services but that would probably disable on-demand AV protection too.

You could "Dismiss" the notice in Windows Security for it, but I do not think it will stay dismissed.