Skip to main content

How to permanently disable Windows Defender Antivirus on Windows 10

Windows Defender Antivirus is the free malware solution that Microsoft includes on every installation of Windows 10. It's a security software package meant to provide the first line of defense to protect your device and data against malware, including viruses, ransomware, rootkits, spyware, and other types of malicious programs.

Although the antivirus runs automatically, and it can disable itself as you install a third-party security software, the only caveat is that Windows 10 doesn't offer a way to disable it permanently. Perhaps the obvious reason is that Microsoft doesn't want you to use your device without any protection, which is a good thing.

However, there are still some cases where some users may prefer not to use Windows Defender Antivirus, such as on a kiosk device that isn't connected to a network and where peripheral connectivity isn't allowed.

In this Windows 10 guide, we'll walk you through the steps to permanently disable the Windows Defender Antivirus on your computer using Group Policy, Registry, and Windows Defender Security Center.

How to disable Windows Defender Antivirus using Group Policy

On Windows 10 Pro, it's possible to use the Group Policy Editor to disable the Windows Defender Antivirus permanently.

  1. Use the Windows key + R keyboard shortcut to open the Run command.
  2. Type gpedit.msc and click OK to open the Local Group Policy Editor.
  3. Browse the following path:Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus
  4. On the right side, double-click the Turn off Windows Defender Antivirus policy.
  5. Select the Enabled option.
  6. Click Apply.
  7. Click OK.
  8. Browse the following path:Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Real-time Protection
  9. On the right side, double-click the Turn on behavior monitoring policy.

  1. Select the Disabled option.
  2. Click Apply.
  3. Click OK.

  1. On "Real-time Protection," double-click the Monitor file and program activity on your computer policy.

  1. Select the Disabled option.
  2. Click Apply.
  3. Click OK.

  1. On "Real-time Protection," double-click the Turn on process scanning whenever real-time protection is enabled policy.
  2. Select the Disabled option.
  3. Click Apply.
  4. Click OK.

  1. On "Real-time Protection," double-click the Turn on behavior monitoring policy.
  2. Select the Disabled option.
  3. Click Apply.
  4. Click OK.

  1. Restart your computer.

Once you've completed the steps, Windows Defender Antivirus will no longer scan and detect malware on your device, even after restarting your computer.

At any time, you can enable the Windows Defender Antivirus using the same steps, but on step No. 5, 10, and 14, make sure to select the Not Configured option. Then just restart your device to apply the changes.

How to disable Windows Defender Antivirus using Registry

The Local Group Policy Editor is not available on Windows 10 Home, but you can still achieve the same results changing the Registry settings.

Warning: This is a friendly reminder that editing the registry is risky, and it can cause irreversible damage to your installation if you don't do it correctly. It's recommended to make a full backup of your PC before proceeding.

  1. Use the Windows key + R keyboard shortcut to open the Run command.
  2. Type regedit, and click OK to open the Registry.
  3. Browse the following path:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
  4. Right-click on the Windows Defender (folder) key, select New, and click on DWORD (32-bit) Value.

  1. Name the key DisableAntiSpyware and press Enter.
  2. Double-click the newly created key and set the value from 0 to 1.
  3. Click OK.

  1. Right-click on the Windows Defender (folder) key, select New, and click on Key.
  2. Name the key Real-Time Protection and press Enter.

  1. Right-click on the Real-Time Protection (folder) key, select New, and click on DWORD (32-bit) Value.
  2. Name the key DisableBehaviorMonitoring and press Enter.
  3. Double-click the newly created key and set the value from 0 to 1.
  4. Click OK.

  1. Right-click on the Real-Time Protection (folder) key, select New, and click on DWORD (32-bit) Value.
  2. Name the key DisableOnAccessProtection and press Enter.
  3. Double-click the newly created key and set the value from 0 to 1.
  4. Click OK.

  1. Right-click on the Real-Time Protection (folder) key, select New, and click on DWORD (32-bit) Value.
  2. Name the key DisableScanOnRealtimeEnable and press Enter.
  3. Double-click the newly created key and set the value from 0 to 1.
  4. Click OK.

After completing the steps, simply restart your computer to disable the Windows Defender Antivirus permanently.

If you change your mind, you can always revert the changes using the same instructions, but on step No. 3, right-click the DisableAntiSpyware key, and select Delete. Then inside the Windows Defender (folder) key, right-click the Real-Time Protection (folder) key and select Delete to remove key and its content. Finally, restart your device to complete reverting the changes.

How to disable Windows Defender Antivirus using Security Center

Alternatively, if you're installing a piece of software that requires deactivating the antivirus to install correctly, or you simply want to disable the Windows 10 built-in antivirus temporarily, you can use the following steps:

  1. Open Windows Defender Security Center.
  2. Click on Virus & threat protection.
  3. Click the Virus & threat protection settings option.

  1. Turn off the Real-time protection toggle switch.

After completing the steps, Windows Defender Antivirus will be disabled making it unable to monitor and stop malware from taking over your device. However, this is a temporary solution, eventually, the antivirus will re-activate automatically after you restart your device.

Wrapping things up

While there could be scenarios where you may need to disable the antivirus, it's never recommended to have your device without malware protection.

If you're trying to get rid of Windows Defender Antivirus because you prefer another security software, you should know that the built-in antivirus will disable itself automatically during the installation of third-party security software.

It's should also be noted that the shield icon will continue to appear in the notification area of the Taskbar because it's the Windows Defender Security Center icon, not merely dedicated to the antivirus.

In the case you don't like the default anti-malware solution, here are a few alternatives that won't cost you a penny for basic protection.

More Windows 10 resources

For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:

Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.

10 Comments
  • why would you be stupid enough to give up the tool that makes your computer secure. you should just post all your information, personal, private, and otherwise on a wiki page and give it to the world.
  • .
  • Because you might be a power user with common sense and enough neurons to not catch malwares. Also, it could be conceivable for one to not want to give up the option of transferring data at 600 MB/s between drives.
  • Thanks to Mauro Huculak for showing the hackers and scammers how to ruin havoc on new Windows 10 devices :)
  • Why would anyone be stupid enough as to actually think they are protected with Windows Defender? It is widely known to be notoriously unreliable in successive AV tests over the years. It has scored well on some occasions, sub-par on most of them and abysmally low on others. There are two very sane reasons for me to want Windows Defender gone from my computers: - The first one is that I already have a professional Endpoint solution running on my machines and I don't want a second one, like Defender, interfering with it.
    - The second one is that Defender detects a staggering amount of false positives. It keeps blocking / removing important files from our legitimate business management software, claiming they are malware. However, in the most recent version of Windows (1709) it is impossible to disable Windows Defender. Even if you disable it, it re-enables itself shortly after.
  • I just find that Windows Defender(w10 pc) can't detect Trojan horse while paid Avast (w7 pc)/Norton(w7 pc) removed it when I connect the defected USB with my w10 / w7 system resp.
  • Could be that those other programs are designed to do more than what Windows defender does right now. Really think that MS will design a built in program that would basically tell consumers no need to buy a third party program to protect your system. Then what happens to all the rest if MS actually made a truly proper antivirus, malware and ransomware utility built into W10? Ms needs those to help them improve their basic protection. I like what MS has done to Windows defender but it's annoying to constantly seeing a pop up about a program trying to change or access a folder when it's simply me playing a vid file saved in a folder on a storage drive. Little things like that would help make it better. Glad for the added alerts and protection but only if it's for a program actually trying something malicious and not because I'm watching a vid file on the windows default player.
  • Whether you get that shouting pop up from Windows or from Norton, A vast, McAfee, etc what's the difference. All anti virus does that.
  • I only use Defender now, with weekly scans using Malwarebytes.
  • Yeah... Don't do this. If you actually have an environment where you need to do this  (enterprise), your IT person should take care of this, and thus would already know how to disable Defender.