Docs
How to Disable Windows Defender (Windows 10 & 11) Safely
Learn how to turn off Windows Defender safely in Windows 10 and 11, including real-time protection, Firewall by command line, and SmartScreen settings.
How-to for Windows users, IT admins, and MSPs who need to turn off Defender protection temporarily or understand which Defender component they are disabling
If you need to disable Windows Defender, the safest path is to turn off only the specific component you actually mean, usually Microsoft Defender Antivirus real-time protection, Windows Defender Firewall, or Microsoft Defender SmartScreen. For most users, Defender Antivirus can only be turned off temporarily in Windows Security unless another antivirus product or organization policy takes over.
That distinction matters because "Windows Defender" can mean several different protections. This page separates antivirus, firewall, and SmartScreen so you can turn off the right feature, understand the tradeoffs, and avoid drifting into unsupported remove-or-uninstall advice.
What You'll Get
- Disable the right Defender component instead of the wrong one
- Understand what Windows lets you turn off temporarily versus what stays policy-controlled
- Use safer alternatives such as exclusions when full disablement is unnecessary
Jump To
How can I disable Windows Defender safely?
For most Windows 10 and Windows 11 systems, "disable Windows Defender" really means turning off Microsoft Defender Antivirus real-time protection for a short period, not uninstalling Defender or disabling every Windows security feature at once. Microsoft's current Windows Security guidance says real-time protection can be turned off from the Windows Security app, but it automatically turns back on after a short while.
That is the safest way to think about this topic: disable only the exact Defender feature you need to test or troubleshoot, and expect Windows to protect itself again unless another supported antivirus product or policy takes over.
Direct answer: To turn off Windows Defender in Windows 10 or 11, open Windows Security, go to Virus & threat protection, open Manage settings, and switch Real-time protection off.
Direct answer: If tamper protection is on, you may need to turn tamper protection off before Windows lets you disable real-time protection.
Direct answer: Do not treat this page as an uninstall or removal guide. Disabling protection temporarily is a separate task from removing Defender.
If the device says settings are locked by policy, use the organization-managed Defender guide before forcing local changes.
How to turn off Windows Defender in Windows 10 and Windows 11
For the main antivirus engine, the supported local path is Windows Security:
- Open Windows Security.
- Select Virus & threat protection.
- Open Manage settings under Virus & threat protection settings.
- Switch Real-time protection off.
Microsoft's support guidance says real-time protection will turn back on automatically after a short while. That is why this is best treated as a temporary troubleshooting or testing step, not a permanent configuration model.
If the toggle is blocked, check these first:
- tamper protection is still on
- the device is managed by work or school policy
- another antivirus product is installed and controlling protection state
If your real goal is to stop repeated scans on one trusted path or process, a narrow exclusion is usually safer than turning Defender off completely. Use the Windows Defender exceptions guide for that path. The broader operational version of the decision is covered in the central management guide.
When you should not disable Defender fully
The safest rule is to disable as little as possible.
| What you are trying to do | Better option | Why |
|---|---|---|
| Stop one file or folder from being scanned | Use an exclusion | Lower risk than turning off all antivirus protection |
| Check whether Defender is causing a false positive | Validate the file and review false-positive handling | You may not need full disablement at all |
| Temporarily test another security tool | Turn off only real-time protection briefly | Windows can restore protection automatically later |
| Change settings on many endpoints | Use policy or central management | Avoids drift and unclear local state |
You should also keep one scope boundary clear: this page does not cover uninstalling, deleting, or permanently removing Windows Defender. That is a separate intent and should not be mixed into a simple how-to page about temporary disablement.
How to turn off Windows Defender Firewall using CMD
If you need to turn off Windows Defender Firewall from the command line, Microsoft's command reference documents this command:
netsh advfirewall set allprofiles state off
That disables the firewall profiles while leaving the firewall service itself in the supported state. Microsoft's firewall command-line guidance explicitly recommends disabling the profiles rather than stopping the Windows Defender Firewall service.
Use that command only from an elevated Command Prompt, and only when you have a clear reason to disable the firewall temporarily. When you are done, turn it back on:
netsh advfirewall set allprofiles state on
If your real need is remote administration rather than total firewall shutdown, handle that through rules and profile management instead of blanket disablement.
How to disable Windows Defender SmartScreen
SmartScreen is not the same feature as Defender Antivirus. It is a reputation-based protection layer, and the exact toggle depends on where you are disabling it.
For Windows reputation-based protection, start in Windows Security > App & browser control. Microsoft's Windows Security guidance exposes SmartScreen-related controls there.
For Microsoft Edge specifically, Microsoft's current Edge support page says you can go to:
- Settings in Edge
- Privacy, search, and services
- Security
- Turn Microsoft Defender SmartScreen on or off
If you are on a work or school device, the SmartScreen setting may be managed by policy and unavailable for local change.
Common mistakes when disabling Windows Defender
The most common mistake is disabling the wrong component. Users often say "Windows Defender" when they actually mean one of three different features:
- Microsoft Defender Antivirus real-time protection
- Windows Defender Firewall
- Microsoft Defender SmartScreen
Other mistakes that create unnecessary risk:
- trying registry hacks before checking tamper protection or policy ownership
- disabling all protections when only one exclusion was needed
- turning off firewall profiles and forgetting to re-enable them
- assuming local admin rights override organization policy
- mixing temporary disablement with uninstall or permanent removal instructions
If the device keeps returning to an unexpected protection state, verify whether the endpoint is actually in passive mode or under another security product's control. The next steps for that are in the passive mode guide and the third-party antivirus handoff guide.
When central control is the better answer
If you need to disable, relax, or test Defender settings across many endpoints, local toggles are the wrong operating model. That is when policy-based management becomes the safer path.
Use central management when:
- you need consistent settings across many devices
- you need to know who changed protection and when
- you need to distinguish temporary test states from broken endpoint posture
- you need reporting after the change, not just the change itself
That broader model is covered in Windows Defender central management. If you want the full troubleshooting hub instead of a single how-to, continue with common problems with Microsoft Defender.