Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To pause Microsoft Defender Antivirus in Windows 11 or Windows 10, open Windows Security, go to Virus & threat protection > Manage settings, and switch Real-time protection off. Use the control only for the task that requires it, then return to the same page and switch it on again. Windows may restore the setting automatically after a short while, but Microsoft does not specify a fixed number of minutes.
What turning off real-time protection actually does
Microsoft Defender Antivirus is built into Windows 10 and Windows 11. Its Real-time protection control determines whether Defender checks files as they are opened, downloaded, or otherwise accessed. Turning that control off is a temporary pause, not a permanent uninstall of Defender and not a shutdown of every Windows security feature.
Microsoft describes the behavior this way: “While real-time protection is off, files you open or download won’t be scanned for threats.” Scheduled scans can still run, but a file downloaded or installed while the toggle is off may wait until the next scheduled scan before Defender examines it. If another compatible antivirus is installed, that product may continue scanning; check which provider Windows reports as active instead of assuming that Defender is the only protection on the PC.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The risk is significant when no other security product is protecting the device. Microsoft warns: “Your device will be vulnerable to malware if you disable Microsoft Defender Antivirus and don’t have another security product.” Keep the pause as short as possible, avoid browsing or opening unknown files during it, and restore protection before resuming normal work.
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Before you disable antivirus protection
- Identify the task. A software installer, developer tool, game, or troubleshooting operation should be the specific reason. Do not leave real-time protection off as a general performance setting.
- Use a trusted source. If the file or installer is not from a source you trust, disabling scanning removes an important warning before the file runs.
- Save work and close unnecessary apps. This reduces the number of files and processes interacting with the system during the unprotected interval.
- Prefer an exclusion for one known item. If one file, folder, file type, or process is being blocked and you understand why, an exclusion limits the scope more narrowly than disabling all real-time checks. Exclusions still reduce protection and must be removed when the task is complete.
- Expect managed-device restrictions. A work, school, or family-managed computer may prevent changes through policy. Do not assume a registry or command-line workaround will be allowed or safe; contact the device administrator or use current Microsoft guidance.
How to turn off Microsoft Defender temporarily
These are Microsoft’s published Windows 10 and Windows 11 navigation labels. The exact availability of a switch can vary with device configuration, edition, updates, or management policy.
- Open the Windows Security app from the Start menu. You can select Start, type Windows Security, and open the matching app.
- Select Virus & threat protection in the left or main navigation area.
- Under Virus & threat protection settings, select Manage settings.
- Find Real-time protection and switch it to Off. Confirm any User Account Control prompt if Windows displays one.
- Perform only the task that required the pause. Do not use the unprotected interval to install unrelated software, open unsolicited attachments, or browse unfamiliar sites.
- Return to Windows Security > Virus & threat protection > Manage settings and switch Real-time protection back to On as soon as the task ends. Windows may turn it on automatically after a short while, but there is no Microsoft-published fixed timer, so verify rather than waiting for automation.
If the control immediately returns to On, another security product or an organizational policy may be managing the setting. If it cannot be changed at all, follow the Tamper Protection checks below.
What protection is reduced while the switch is off?
| Activity or protection layer | What to expect |
|---|---|
| Files you open or download | They are not scanned by Defender in real time while the switch is off, according to Microsoft. |
| Scheduled Defender scans | Scheduled scans can continue. A downloaded or installed file may not be checked until the next scheduled scan. |
| Other Windows security features | Turning off this switch does not mean every Windows Security feature is disabled. Firewall, account protection, device security, and other controls have their own settings. |
| Another compatible antivirus | A third-party product may continue to provide protection. Windows can place Defender into a different operating mode when another compatible provider is installed, so verify the active provider. |
| Automatic restoration | Microsoft says real-time protection is temporary and can turn back on after a short while. No exact duration is specified. |
After re-enabling the switch, scan any file that was downloaded, extracted, or installed during the pause. You can right-click an item in File Explorer and choose the Windows Security scan command where available, or use the Windows Security app’s scan controls. A manual scan is a prudent verification step; it does not make disabling protection risk-free.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhen Tamper Protection prevents the change
Tamper Protection is designed to stop unwanted changes to important security settings. Microsoft notes that when it is on, you may need to turn it off before Windows will allow Real-time protection to be switched off. The relevant controls are in Windows Security > Virus & threat protection > Manage settings.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Open Windows Security and select Virus & threat protection.
- Select Manage settings under the settings heading.
- Review Tamper Protection. If policy allows and the task genuinely requires a temporary pause, switch it off and approve the prompt.
- Switch Real-time protection off, complete the narrowly defined task, then return to the same page.
- Restore Real-time protection and the original Tamper Protection state. Leaving Tamper Protection off removes an additional safeguard against unauthorized security changes.
If Tamper Protection is locked, greyed out, or immediately resets, the device may be managed by an organization or another security provider. Do not keep attempting increasingly invasive workarounds; ask the administrator to approve the required operation or consult Microsoft’s current support instructions.
Use an exclusion when only one file or folder is involved
Microsoft identifies an exclusion as a safer, narrower alternative when you know the exact item that is causing a conflict. Windows Security can exclude a file, folder, file type, or process. The trade-off is that the selected scope is omitted from Defender’s real-time scanning, so malicious content placed there may not trigger the usual real-time warning.
To add one, open Windows Security > Virus & threat protection > Manage settings, scroll to Exclusions, choose Add or remove exclusions, approve the permission prompt, select Add an exclusion, and choose the relevant item type. Browse to the exact file or folder rather than excluding an entire drive or broad download location. For a process exclusion, Microsoft recommends specifying the full process path and filename; files opened by that process can be covered by the exclusion.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Choice | Scope of reduced Defender real-time scanning | Other scan behavior | When it fits |
|---|---|---|---|
| Real-time protection off | Broad: files accessed during the pause are not checked in real time. | Scheduled scans may continue; another antimalware product may still scan. | A short, controlled troubleshooting step when a narrower choice cannot address the problem. |
| File exclusion | One named file is excluded. | It remains outside Defender real-time checks until the exclusion is removed; other products may apply their own rules. | A known installer, build artifact, or document that is repeatedly detected. |
| Folder exclusion | Items in the selected folder are excluded from Defender real-time checks. | Scheduled and third-party scanning rules can differ; the folder is still a lower-protection location. | A dedicated, controlled working directory whose contents you review. |
| File-type exclusion | Every matching extension can be excluded, potentially across many locations. | Broad impact makes accidental exposure more likely. | Only when you fully understand the extension and its use. |
| Process exclusion | Files opened by the specified process can be excluded. | Using a broad or incorrectly specified process path can create a larger gap than intended. | A trusted tool that repeatedly triggers a false positive while operating on known data. |
Microsoft cautions that exclusions can make the device or data more vulnerable. They do not necessarily exempt an item from every scheduled scan or from scans performed by third-party antimalware. Remove the exclusion from Add or remove exclusions when the conflict is resolved, then run a scan of the affected location.
Rank #3
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Turn protection back on and confirm the active provider
Do not rely on a notification or on memory to determine whether the PC is protected. Open Windows Security and review Virus & threat protection. The page identifies the current provider and shows whether real-time protection is enabled for that provider. If you installed a compatible non-Microsoft antivirus, Windows may automatically place Defender into disabled or passive operation; that behavior is different from manually leaving every antivirus inactive.
- Open Windows Security from Start.
- Select Virus & threat protection.
- Check the displayed provider and protection status.
- Under Virus & threat protection settings, select Manage settings and confirm Real-time protection is On for the provider that is meant to protect the device.
- If you used an exclusion, open Add or remove exclusions, remove the temporary entry, and scan the file or folder.
Microsoft’s Antivirus and antimalware software FAQ explains that Defender is built into Windows 10 and Windows 11 and can turn itself on when another security product is absent or expired. A compatible non-Microsoft antivirus can instead cause Defender to change operating mode automatically. The Windows Security provider listing is the reliable way to tell which product is currently responsible for protection.
Why the Real-time protection switch cannot be changed
The switch is greyed out or blocked
Check Tamper Protection first. If it is enabled, Microsoft says it may need to be turned off before Real-time protection can be changed. If both settings are locked, an administrator policy, security baseline, or managed-device configuration is a more likely explanation than a missing button.
The switch turns itself back on
Automatic restoration is expected: Microsoft describes Real-time protection as a temporary setting. A security policy or another antivirus can also enforce its preferred state. Treat the return to On as protection being restored, not as a failure to troubleshoot.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The switch stays off or Windows reports no provider
Open the provider status in Windows Security, reconnect the PC to its normal management environment if it is a work device, and restart only if your organization’s procedures permit it. Do not install an unverified security utility simply to fill the gap. If a compatible antivirus was recently removed or expired, Windows may need to re-establish Defender as the active provider.
An installer still fails after Defender is paused
The block may come from another antivirus, SmartScreen, controlled folder access, application reputation, permissions, or the installer itself. Re-enable Defender before investigating those other causes. Disabling one protection layer does not guarantee that an application will be allowed to run.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing the least risky option for common situations
- One false-positive file: Prefer a file exclusion, verify the file’s origin and integrity, use it, then remove the exclusion and scan it.
- A build directory that constantly triggers detections: Consider a narrowly scoped folder exclusion only if the directory is controlled and its contents are reviewed. Do not exclude a general Downloads folder.
- A process-specific development conflict: A full-path process exclusion may be narrower than disabling all real-time protection, but it can cover files that process opens. Reassess it whenever the tool’s installation path changes.
- A one-time installer that cannot be inspected otherwise: Pause protection only for the shortest controlled interval, complete the installation, restore protection, and scan the downloaded installer and installed files.
- A managed work or school computer: Ask the administrator to create an approved exception. A local change may violate policy or be automatically reversed.
Official Microsoft guidance
- Stay protected with the Windows Security app — Windows 10 and Windows 11 scope, the temporary Real-time protection control, and what is not scanned while it is off.
- Virus and Threat Protection in the Windows Security App — Tamper Protection, exclusions, and scheduled-scan qualifications.
- Scan an item with Windows Security — scanning an individual item and checking behavior when another antivirus is installed.
Frequently asked questions
Does turning off Real-time protection uninstall Microsoft Defender?
No. It changes a temporary scanning control. Defender remains part of Windows, and other Windows Security features have separate controls.
Can I choose an exact number of minutes for the pause?
No Microsoft-documented timer is exposed in this control. The setting may restore itself after a short while, so set your own reminder and verify that protection is back on.
Best Value
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
Will a scheduled scan protect a file immediately after I download it?
No. While Real-time protection is off, the download is not checked in real time. A scheduled scan can examine it later, but the timing of that scan is not an immediate guarantee.
Is an exclusion harmless if the file is trusted?
No. It reduces Defender’s real-time coverage for the selected scope, and a trusted location can later receive an untrusted file. Keep exclusions narrow, temporary, and documented.
Frequently Asked Questions
Can I choose an exact number of minutes for the pause?
No. Microsoft does not publish a fixed timer for Real-time protection. It may turn back on after a short while, so verify the setting yourself.
Does turning off Real-time protection disable every Windows security feature?
No. It changes Defender’s real-time scanning control; other Windows Security features have separate settings.
Will a scheduled scan check a download immediately?
No. A download is not scanned in real time while the switch is off. A scheduled scan may examine it later.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
