How to Temporarily Disable Microsoft Defender Real-Time Protection

Quick fix: Open Windows Security → Virus & threat protection → Manage settings. Toggle Real-time protection Off. Windows automatically re-enables it after a brief idle period (usually 15 minutes) — so this is genuinely temporary and self-healing.

You need to install legacy software, run a security tool, or work with a file Defender is mis-quarantining. Real-time protection blocks the action. You want it off temporarily, without disabling protection permanently. Windows 11 has a built-in “temporarily off” mode that auto-re-enables to ensure you don’t accidentally leave protection off forever.

What causes this

Microsoft Defender real-time protection scans every file accessed. For specific legitimate tasks (old software installers, security scanners, low-level system tools), the scanning is unwanted overhead — or worse, false-positive quarantines. Windows allows temporary disable with automatic re-enable to balance flexibility against the risk of leaving protection off.

If Tamper Protection is on, real-time protection can’t be disabled via automation (only through the UI with admin confirm). This is intentional — to prevent malware from disabling AV.

Method 1: Toggle real-time protection off via Windows Security

The supported one-click approach.

1. Open Windows Security (search “Windows Security” in Start, or click the shield icon in the system tray).
2. Click Virus & threat protection.
3. Under Virus & threat protection settings, click Manage settings.
4. Toggle Real-time protection Off.
5. Confirm the UAC prompt.
6. Real-time protection is now off. The shield icon shows a yellow warning. Do whatever you need (install software, run tool).
7. Windows auto-re-enables protection after about 15 minutes of idle time, or on the next reboot. To re-enable immediately, toggle it back On.

This is the right approach for one-off legitimate tasks.

Method 2: Disable via PowerShell when Tamper Protection is off

Use when you need scriptable disable for automated maintenance.

1. First disable Tamper Protection: Windows Security → Virus & threat protection → Manage settings → Tamper Protection → Off.
2. Open Terminal (Admin).
3. Disable real-time protection:

   Set-MpPreference -DisableRealtimeMonitoring $true

4. Verify:

   Get-MpPreference | Select DisableRealtimeMonitoring

   Should return True.

5. Do your work.
6. Re-enable real-time protection:

   Set-MpPreference -DisableRealtimeMonitoring $false

7. Re-enable Tamper Protection via Windows Security UI.

For automation, wrap your task in a script that disables protection, runs the task, re-enables protection.

Method 3: Use Defender Offline scan for tasks requiring no Defender at all

When you need Defender completely out of the way — e.g., running a competing AV scanner.

1. Open Windows Security → Virus & threat protection → Scan options.
2. Choose Microsoft Defender Offline scan. Click Scan now.
3. The PC reboots into a minimal Defender Offline environment. Defender runs with elevated capabilities; normal Windows isn’t loaded.
4. For your own tools: use Safe Mode instead. Boot to Safe Mode via Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → Startup Settings → F4.
5. In Safe Mode, Defender runs in reduced mode. Many tools that conflict with Defender real-time work fine in Safe Mode.

This is the right environment for tools that need a Defender-minimal context.

How to verify the fix worked

• Open Windows Security → Virus & threat protection. Real-time protection shows Off with a yellow warning.
• Run Get-MpComputerStatus | Select RealTimeProtectionEnabled in PowerShell. Returns False during disable.
• Do your task. Defender does not scan or interfere.
• After 15 minutes idle, Defender auto-re-enables. Real-time protection shows On.

If none of these work

If the toggle doesn’t work or PowerShell returns errors, three causes apply. Tamper Protection is on: Tamper Protection blocks all programmatic and most UI-based Defender modifications. Disable Tamper Protection first via Method 1’s Windows Security UI. Group Policy override: corporate-managed PCs may enforce real-time protection. Contact IT for an exception, or use Method 3 (Safe Mode) which Group Policy can’t override. Defender is being managed by another AV: when a third-party AV is installed, Defender enters reduced mode and its toggles may be greyed. Disable the third-party AV first if appropriate. For tasks that genuinely require Defender off across reboots (rare), Group Policy Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Turn off Microsoft Defender Antivirus works on Pro/Enterprise editions.

Bottom line: Temporary Defender disable is supported and self-healing — toggle off in Windows Security, do your work, auto-re-enables after 15 minutes. PowerShell works for automation when Tamper Protection is off.