Fix Defender Real-Time Protection Slowing Folder Operations in Windows 11

When you open a folder with many files or run a script that processes hundreds of documents, Windows 11 may become unresponsive for several seconds. The folder contents appear slowly, and file operations like copy, move, or delete take much longer than expected. This slowdown is often caused by Microsoft Defender Antivirus scanning every file as it is accessed. The real-time protection feature checks each file for threats, and on folders with many small files or archive contents, this scanning can consume significant CPU and disk resources. This article explains why Defender causes folder delays, provides steps to adjust or temporarily disable real-time protection, and covers related issues you may encounter.

Why Defender Real-Time Protection Slows Folder Operations

Microsoft Defender Antivirus uses real-time protection to scan files when they are opened, created, modified, or executed. This scanning happens in the background and is designed to catch malware before it can run. On folders that contain a large number of small files, such as source code repositories, image libraries, or document archives, the scanning overhead adds up quickly. Each file triggers a scan, and the cumulative effect can cause Windows Explorer to freeze or update slowly.

The root cause is the file system filter driver that Defender installs. This driver intercepts every file I/O operation and passes the file data to the Defender scanning engine. If the engine is busy or the disk is slow, the I/O operation waits until scanning finishes. Folders with thousands of files, especially those with nested subfolders, create a queue of scan requests that can delay folder browsing and file operations by several seconds or more.

Common Scenarios Where Slowdown Occurs

Users often notice the lag in these situations:

• Opening a folder containing many small image files, such as JPEG or PNG thumbnails
• Running build scripts or compilers that create and delete many temporary files
• Copying or moving folders with hundreds of documents from one drive to another
• Extracting a ZIP or RAR archive with many small files inside

Steps to Confirm and Fix Folder Slowdown Caused by Defender

Before making permanent changes, confirm that Defender real-time protection is the cause. The quickest method is to temporarily disable real-time protection and test folder performance. If the slowdown disappears, you can then apply one of the permanent solutions below.

Confirm the Problem by Disabling Real-Time Protection Temporarily

1. Open Windows Security
   Press the Windows key, type Windows Security, and press Enter.
2. Go to Virus & threat protection
   Click Virus & threat protection in the left sidebar.
3. Open Manage settings
   Under the Virus & threat protection settings section, click Manage settings.
4. Turn off Real-time protection
   Set the Real-time protection toggle to Off. Confirm any UAC prompt that appears.
5. Test folder performance
   Open the folder that was slow before. If it now opens quickly, Defender real-time protection is the cause. Note that real-time protection will turn back on automatically after a short period, usually within a few minutes.

Add Folder Exclusions to Keep Protection Active Elsewhere

Instead of disabling protection entirely, exclude the specific folder or file type from scanning. This keeps Defender active for all other locations while preventing delays in the excluded folder.

1. Open Windows Security and go to Virus & threat protection
   Press the Windows key, type Windows Security, and press Enter. Click Virus & threat protection.
2. Open Manage settings
   Click Manage settings under Virus & threat protection settings.
3. Scroll to Exclusions
   Under the Exclusions section, click Add or remove exclusions.
4. Add an exclusion
   Click Add an exclusion and choose Folder from the dropdown menu.
5. Select the folder
   Browse to the folder that is slow, select it, and click Select Folder. The folder and all its subfolders will be excluded from real-time scanning.
6. Test performance
   Open the folder again and verify that it loads quickly. You can add multiple exclusions for different folders if needed.

Exclude Specific File Types Instead of Folders

If the slowdown is caused by a particular file type, such as .tmp files created by a build tool, exclude that extension rather than the whole folder. This keeps scanning active for other file types in the same location.

1. Follow steps 1 through 3 from the previous section
   Open Windows Security, go to Virus & threat protection, then Manage settings, and click Add or remove exclusions.
2. Add an exclusion for a file type
   Click Add an exclusion and choose Extension from the dropdown.
3. Enter the file extension
   Type the extension without the dot, for example tmp or log. Click Add.
4. Test performance
   Run the operation that was slow and check if performance improves.

Disable Real-Time Protection Permanently via Group Policy

This method is intended for IT administrators managing multiple devices. Disabling real-time protection permanently exposes the system to malware and is not recommended for everyday use. Only apply this if you have a separate antivirus solution installed.

1. Open Local Group Policy Editor
   Press the Windows key, type gpedit.msc, and press Enter. This tool is available only in Windows 11 Pro, Enterprise, or Education editions.
2. Navigate to Defender real-time protection policies
   Go to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection.
3. Enable the policy to turn off real-time protection
   Double-click Turn off real-time protection. Set it to Enabled, then click OK.
4. Apply the change
   Close the Group Policy Editor. Open a Command Prompt as administrator and run gpupdate /force to apply the policy immediately.
5. Verify the change
   Open Windows Security and check that Real-time protection shows as Off. The setting will remain off until you change the policy back to Not Configured or Disabled.

If Folder Operations Are Still Slow After the Main Fix

Defender Real-Time Protection Still Causes Delays After Adding Exclusions

If you added an exclusion but the folder remains slow, the exclusion may not apply correctly. First, verify that the exclusion is listed in Windows Security under Add or remove exclusions. If it is present, try removing it and adding it again. Also check that the folder path is correct and does not contain a trailing backslash. On some systems, exclusions for network drives or mapped drives may not work as expected. In that case, use the local path instead.

Slowdown Occurs in Folders That Are Already Excluded

If the folder is excluded but still slow, the cause may be something other than Defender. Try disabling real-time protection entirely as described in the confirmation steps. If the slowdown persists with protection off, the issue is likely due to other factors such as Windows Search indexing, file thumbnail generation, or a slow hard drive. Disable indexing for that folder by right-clicking the folder, selecting Properties, clicking Advanced, and unchecking Allow files to have contents indexed.

Real-Time Protection Turns Back On Automatically

Windows 11 automatically re-enables real-time protection after a short period if you turn it off from the Windows Security interface. This is a security feature to prevent users from leaving protection disabled. To keep it off longer, use the Group Policy method or configure a scheduled task to disable it. The only reliable way to keep it off permanently is through Group Policy or by installing a third-party antivirus, which automatically disables Defender.

Item	Temporary Disable	Folder Exclusion
Duration of effect	Minutes until auto-reenabled	Permanent until removed
Security impact	Full system unprotected	Only excluded folder unprotected
Best for	Quick diagnosis	Ongoing use with specific folders
Complexity	Simple, no admin tools needed	Moderate, requires path selection

You can now identify and resolve folder slowdowns caused by Defender real-time protection. Start by confirming the issue with a temporary disable, then apply a folder or file-type exclusion to keep protection active elsewhere. For advanced users, Group Policy provides a permanent disable option, but this should be used only with an alternative antivirus solution. If slowdowns persist after exclusions, check Windows Search indexing and disk health as additional causes.