How to Disable Windows Defender on Windows 11

You probably don’t need to disable it. I get asked this constantly and nine times out of ten the actual problem is Defender using too much CPU during a scan, or blocking a file the person knows is safe. Both of those have targeted fixes that don’t leave your machine unprotected.

For the CPU issue: MsMpEng.exe (Antimalware Service Executable) sitting at 20-40% CPU usually means a scheduled scan or real-time protection is scanning a large directory. Add exclusions for folders it doesn’t need to touch — dev environments, game libraries, virtual machine files. Windows Security, Virus & threat protection, Manage settings, scroll to Exclusions, Add an exclusion. Add your Steam library, your code projects folder, any VM disk images. I’ve seen Defender spend forty minutes scanning a 200GB game library for threats that will never exist there.

For the blocked file: Windows Security, Virus & threat protection, Protection history. Find the item, click it, choose Allow. Or submit it to Microsoft if you think it’s a false positive. Defender blocks cracked software and keygens aggressively — if that’s what you’re trying to run, I’m not going to tell you how, but a sandbox or VM is safer than turning off your antivirus.

Temporarily Disabling Real-Time Protection

Windows Security, Virus & threat protection, Manage settings, toggle off Real-time protection. It stays off until the next restart or until Windows turns it back on, which can happen in as little as fifteen minutes. This is by design — Microsoft doesn’t want you to forget you turned it off.

For a longer temporary disable, Group Policy works if you have Windows 11 Pro. Win+R, gpedit.msc, Computer Configuration, Administrative Templates, Windows Components, Microsoft Defender Antivirus, Turn off Microsoft Defender Antivirus, set to Enabled. Restart. This keeps it off until you set it back to Not Configured. Home edition doesn’t have Group Policy.

Registry method works on all editions: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender, create a DWORD called DisableAntiSpyware, set it to 1. Restart. Same effect as Group Policy. Set it to 0 or delete the value to re-enable.

Both of these will get overridden eventually by Windows Update or a feature update, which is actually a good safety net. If you forget about it for six months, Defender comes back.

Tamper Protection

Here’s where people get stuck. Even with Group Policy or the registry trick, Defender sometimes ignores the setting and stays running. That’s Tamper Protection. Windows Security, Virus & threat protection, Manage settings, scroll down to Tamper protection, toggle it off first. Then apply your Group Policy or registry change. Then restart. Without disabling Tamper Protection first, Windows just silently reverts your changes.

Why Not to Disable It Permanently

Defender in 2026 consistently scores 99-100% detection in independent testing from AV-TEST. It’s not the resource hog it was in 2018. It runs on all Windows machines, so every piece of malware targets Defender evasion first — and Microsoft patches those evasions fast because they have telemetry from hundreds of millions of machines.

If Defender is causing high CPU usage that exclusions don’t fix, or if you’re installing a different antivirus (Bitdefender, Kaspersky, ESET), Defender disables its real-time engine automatically when it detects another antivirus installed. You don’t need to manually disable it in that case — it steps aside on its own. If your main complaint is that Defender is slowing down your entire system, the exclusions approach is almost always enough.