How to disable Defender Antivirus permanently on Windows 11

Turning off the Windows 11 antivirus is a tedious process, but it's possible to complete this task, and here's how.

Avatar for Mauro Huculak
@Pureinfotech
Pureinfotech Logo
Windows 11 with Microsoft Defender Antivirus disabled
Windows 11 with Microsoft Defender Antivirus disabled
  • To disable the Microsoft Defender Antivirus permanently on Windows 11, in the “Windows Defender” key in the Registry, create the “Real-Time Protection,” “Signature Updates,” and “Spynet” subkeys, and you must create 11 different “DWORD (32-bit) Value” entries with the value of “1,” including: “DisableAntiSpyware,” “DisableRealtimeMonitoring,” “DisableAntiVirus,” “DisableSpecialRunningModes,” “DisableRoutinelyTakingAction.” The “ServiceKeepAlive” key should be set to “0”.

On Windows 11, it’s possible to disable the Microsoft Defender Antivirus solution “permanently,” and in this guide, I’ll show you how to complete this configuration by modifying the Registry.

Microsoft Defender Antivirus is the built-in antivirus software for Windows 11, designed to scan and protect your computer from viruses, spyware, hackers, and other online threats. While it’s generally recommended to keep the antivirus enabled, there may be instances where you need to disable it completely, such as when it causes performance issues, conflicts with other antivirus software, or you’re concerned about privacy.

If you must disable Defender Antivirus permanently, the recommended approach is to install another antivirus, as this action will trigger the system to turn off the anti-malware application automatically (and enable the option to turn on periodic scanning). However, it’s also possible to permanently disable the antivirus on Windows 11 through the Registry. But it’s a decision that should not be taken lightly, as it leaves your computer vulnerable to malware attacks.

In this guide, I will outline the steps to permanently turn off the default antivirus on Windows 11 Pro or Home.

Warning: It’s crucial to note that modifying the Registry can cause serious problems if not used properly. It’s assumed you know what you’re doing and created a full backup of your system before proceeding. Also, it’s never a good idea to run a device without an antivirus. As such, use these steps at your own risk. If you only want to turn off the antivirus temporarily, on Windows Security > Virus & threat protection > Manage settings, turn off the “Real-time protection” toggle switch, then restarting the computer or turning on the option again will restore the antivirus.

Disable Microsoft Defender Antivirus on Windows 11

To disable Microsoft Defender Antivirus permanently on Windows 11, use these steps:

  1. Open Start on Windows 11.

  2. Search for Windows Security and click the top result to open the app.

  3. Click on Virus & threat protection.

  4. Click the Manage settings option under the “Virus & threat protection settings” section.

    Microsoft Defender Antivirus manage settings option

  5. Turn off the Tamper Protection toggle switch.

    Microsoft Defender Antivirus disable Tamper Protection

    Quick note: If you don’t turn off this feature manually, the Registry modifications won’t take effect.

  6. Open Start.

  7. Search for regedit and click the top result to open the Registry Editor.

  8. Navigate to the following path:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

  9. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

    Registry Windows Defender create DWORD

  10. Name the DWORD DisableAntiSpyware and press Enter.

  11. Right-click the newly created DWORD and choose the Modify option.

  12. Change the “DisableAntiSpyware” value from 0 to 1.

    Registry DisableAntiSpyware DWORD

  13. Click the OK button.

  14. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

  15. Name the DWORD DisableRealtimeMonitoring and press Enter.

  16. Right-click the newly created DWORD and choose the Modify option.

  17. Change the “DisableRealtimeMonitoring” value from 0 to 1.

  18. Click the OK button.

  19. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

  20. Name the DWORD DisableAntiVirus and press Enter.

  21. Right-click the newly created DWORD and choose the Modify option.

  22. Change the “DisableAntiVirus” value from 0 to 1.

  23. Click the OK button.

  24. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

  25. Name the DWORD DisableSpecialRunningModes and press Enter.

  26. Right-click the newly created DWORD and choose the Modify option.

  27. Change the “DisableSpecialRunningModes” value from 0 to 1.

  28. Click the OK button.

  29. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

  30. Name the DWORD DisableRoutinelyTakingAction and press Enter.

  31. Right-click the newly created DWORD and choose the Modify option.

  32. Change the “DisableRoutinelyTakingAction” value from 0 to 1.

  33. Click the OK button.

  34. Right-click the Windows Defender key, select New, and choose the “DWORD (32-bit) Value” option.

  35. Name the DWORD ServiceKeepAlive and press Enter.

  36. Right-click the newly created DWORD and choose the Modify option.

  37. Confirm the “ServiceKeepAlive” value is 0.

  38. Click the OK button.

  39. Right-click the Windows Defender key, select New, and choose the “Key” option.

    Registry create Real-Time Protection key

  40. Name the key Real-Time Protection and press Enter.

  41. Right-click the “Real-Time Protection” key, select New, and choose the “DWORD (32-bit) Value” option.

    Registry Real-Time Protection create DWORD

  42. Name the DWORD DisableBehaviorMonitoring and press Enter.

  43. Right-click the newly created DWORD and choose the Modify option.

  44. Change the “DisableBehaviorMonitoring” value from 0 to 1.

    Registry DisableBehaviorMonitoring DWORD

  45. Click the OK button.

  46. Right-click the “Real-Time Protection” key, select New, and choose the “DWORD (32-bit) Value” option.

  47. Name the DWORD DisableOnAccessProtection and press Enter.

  48. Right-click the newly created DWORD and choose the Modify option.

  49. Change the “DisableOnAccessProtection” value from 0 to 1.

  50. Click the OK button.

  51. Right-click the “Real-Time Protection” key, select New, and choose the “DWORD (32-bit) Value” option.

  52. Name the DWORD DisableScanOnRealtimeEnable and press Enter.

  53. Right-click the newly created DWORD and choose the Modify option.

  54. Change the “DisableScanOnRealtimeEnable” value from 0 to 1.

  55. Click the OK button.

  56. Right-click the “Real-Time Protection” key, select New, and choose the “DWORD (32-bit) Value” option.

  57. Name the DWORD DisableRealtimeMonitoring and press Enter.

  58. Right-click the newly created DWORD and choose the Modify option.

  59. Change the “DisableRealtimeMonitoring” value from 0 to 1.

  60. Click the OK button.

  61. Right-click the Windows Defender key, select New, and choose the “Key” option.

  62. Name the key Signature Updates and press Enter.

  63. Right-click the Signature Updates key, select New, and choose the “DWORD (32-bit) Value” option.

  64. Name the DWORD ForceUpdateFromMU and press Enter.

  65. Right-click the newly created DWORD and choose the Modify option.

  66. Change the “ForceUpdateFromMU” value from 0 to 1.

    Registry ForceUpdateFromMU DWORD

  67. Click the OK button.

  68. Right-click the Windows Defender key, select New, and choose the “Key” option.

  69. Name the key Spynet and press Enter.

  70. Right-click the Spynet key, select New, and choose the “DWORD (32-bit) Value” option.

  71. Name the DWORD DisableBlockAtFirstSeen and press Enter.

  72. Right-click the newly created DWORD and choose the Modify option.

  73. Change the “DisableBlockAtFirstSeen” value from 0 to 1.

    Registry DisableBlockAtFirstSeen DWORD

  74. Click the OK button.

  75. Restart the computer.

Once you complete the steps, the Microsoft Defender Antivirus should be completely disabled on Windows 11 Home and Pro.

If you change your mind, you can revert the changes, but in step 8, make sure to right-click and delete the “DisableAntiSpyware,” “DisableRealtimeMonitoring,” “DisableAntiVirus,” “DisableSpecialRunningModes,” “DisableRoutinelyTakingAction,” and “ServiceKeepAlive” DWORDs, and right-click and delete the “Real-Time Protection,” “Signature Updates,” and “Spynet” keys. Also, on Windows Security > Virus & threat protection > Manage Settings, turn on the “Tamper Protection” toggle switch, and restart the computer.

Although it’s not recommended to use your computer without an antivirus, these instructions will help you keep Microsoft Defender Antivirus completely disabled on Windows 11, even after restarting the computer.

Update November 5, 2024: This guide has been updated to ensure accuracy and reflect changes to the process.

About the author
Avatar for Mauro Huculak

Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 15 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 21 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter), YouTube, LinkedIn and About.me. Email him at [email protected].