How to turn off Windows Defender in Windows 11 and 10: fully or for one folder
Turn off Windows Defender in Windows 11 and 10 completely or just for your loader folder. Why it turns itself back on and how to restore a quarantined file.
- An exclusion is often enough: add the loader folder to “Exclusions” and Defender stops touching it.
- To turn it off completely, go in order: Tamper Protection, the other toggles, startup, a restart and the Defender Control tool.
- A deleted file isn’t gone: it sits in “Protection history”, and you can restore it from there.
- Third-party antiviruses (Kaspersky, Avast, ESET) have to be uninstalled, not paused.
Contents9
You download a loader, unpack it — and a second later it’s gone. A “Threats found” toast pops up in the corner, and the file is in quarantine. That’s Windows Defender: the built-in antivirus treats almost any software that reaches into other programs’ memory as suspicious.
You don’t always need to remove it completely: an exclusion for a single folder is often enough. Turning it off fully is for when the product’s instructions ask for it.
What in Defender gets in the way
Defender isn’t a single switch but several protections, and each one gets in the way differently.
- SmartScreen won’t open a downloaded file
- Real-time protection moves the loader to quarantine
- Cloud-delivered protection sends the file to Microsoft for a check
- Tamper Protection restores settings — turn it off first
Hence the main rule: turn off Tamper Protection first. While it’s on, Windows puts the other settings back by itself, and it looks like nothing works.
Option 1: an exclusion for one folder
The gentlest way. Defender keeps guarding the system but stops touching the one folder where you keep the loader.
- Create a separate folder, for example
C:\Games\Loader. Don’t put anything else in it. - Open Start → Settings → Privacy & security → Windows Security → Virus & threat protection.
- Under “Virus & threat protection settings”, click Manage settings.
- Scroll to Exclusions, click Add or remove exclusions → Add an exclusion → Folder and pick the folder you created.
- Only now download and unpack the loader into that folder.
Option 2: turn it off for a while
Good for downloading and unpacking a file once.
- Open Windows Security → Virus & threat protection → Manage settings.
- Turn off Tamper Protection, then Real-time protection.
- Confirm the User Account Control prompt.
After a while, or after a restart, Windows turns real-time protection back on by itself: that’s by design. It isn’t enough for a loader you run regularly.
Option 3: turn it off completely
This is how our product instructions disable Defender, and most products launch with this order.
- Flip the toggles. In “Manage settings”, one by one: Tamper Protection, Real-time protection, Cloud-delivered protection, Automatic sample submission.
- Turn off reputation-based protection. “Windows Security → App & browser control → Reputation-based protection → Settings”: untick everything, SmartScreen included.
- Remove Defender from startup. Ctrl + Shift + Esc → “Startup apps” tab → Windows Security notification icon → “Disable”.
- Restart the computer. Some services only unload after a restart.
- Finish it with Defender Control. Download Defender Control (archive password:
r1xon), run it as administrator and click Disable Windows Defender. The tile turns red.
Windows 10 and 11 Pro have one more route through Group Policy: gpedit.msc → “Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus” → set “Turn off Microsoft Defender Antivirus” to “Enabled”. It also only works with Tamper Protection off. The Home edition doesn’t have this console.
Defender deleted a file: how to get it back
A file Defender flagged as a threat isn’t gone for good — it sits in quarantine.
- Open Windows Security → Virus & threat protection → Protection history.
- Find the entry with your file. It shows the path the file was taken from.
- Click Actions → Restore or Allow on device.
So it doesn’t happen again, add the folder to exclusions or turn protection off first, and only then restore.
The “Windows protected your PC” window
That’s not Defender but SmartScreen: it won’t open a downloaded file that few people have run. You don’t need to delete anything.
Click More info, then Run anyway. To stop the window from appearing, turn SmartScreen off under “Reputation-based protection” (step 2 of option 3).
Why Defender turns itself back on
- Tamper Protection is still on. It restores the other settings. Turn it off first.
- The temporary pause ran out. The “Real-time protection” toggle switches itself back on after a while.
- A major Windows update arrived. Settings sometimes reset after one: check them again.
- A third-party antivirus is installed. Kaspersky, Avast, ESET and the like get in the loader’s way just like Defender. You need to uninstall them, not pause them: the antivirus driver stays in the system.
How to turn Defender back on
If you used the tool, run it again and click Enable Windows Defender. Then turn the toggles back on in “Manage settings”, starting with real-time protection and finishing with Tamper Protection. If you changed Group Policy, set the setting back to “Not configured”.
Defender rarely gets in the way alone. Secure Boot and Core Isolation usually sit next to it. The checker finds all of it at once:
FAQ
The PC is left without an antivirus, so be careful about what you download and run. An exclusion for one folder is the gentler option: Defender keeps guarding the rest of the system.
Usually Tamper Protection is still on, the temporary pause ran out, or a major Windows update arrived. Turn Tamper Protection off first and check the settings after updates.
Through Windows Security and the Defender Control tool. The Home edition has no Group Policy, so the gpedit.msc route doesn’t work there.
Yes. Pausing doesn’t help: the antivirus driver stays in the system and gets in the loader’s way just like Defender. Restart the PC after uninstalling.
