Unfortunately sometimes it is needed to disable (and later enable again) the (excellent) Windows defender real time protection.

I require 7 clicks to enable or disable Defender real time protection: Systray -> double on icon -> "Virus & threat protection" -> "Virus & threat protection settings" -> Toggle "Real-time protection" -> User Account Control "Yes".

Is there a simpler way to create a desktop shortcut that minimizes the number of clicks needed?

  • I'd think you can maybe toggle a service, can you explain why you need to disable/enable it? Oct 5, 2017 at 15:48
  • The process is requiring too much CPU, slowing processes stuff down. I couldn't find out which files/processes are causing this. See my related question: superuser.com/q/1256548/25933
    – janpio
    Oct 5, 2017 at 15:51
  • I doubt there will be such a simple way to disable Windows Defender. There is a reason for this. If there was a simple way to disable Windows Defender malware authors would know all about it and the protection it provides would be nullified. The interactive process used cannot be easily duplicated with software. The Windows Defender service cannot be directly stopped by even an elevated admin account.
    – LMiller7
    Oct 5, 2017 at 18:06
  • It actually can, but @djsmiley2k unfortunately posted the answer in the wrong question: superuser.com/a/1256561/25933
    – janpio
    Oct 5, 2017 at 18:15

3 Answers 3


To actually toggle the real-time monitoring state put the following in a PowerShell script (must be run as administrator):

$preferences = Get-MpPreference
Set-MpPreference -DisableRealtimeMonitoring (!$preferences.DisableRealtimeMonitoring)

To make this into a desktop shortcut, right-click on the Desktop, choose "New" and then "Shortcut" and enter the following for the item (substituting the location of the script you created for the -File argument)

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\yuji\Documents\toggle-monitoring.ps1"

And in the Advanced options, enable Run as administrator.

  • 1
    You are absolutely right, this works perfect! Thank you.
    – janpio
    Jan 22, 2018 at 12:54
  • This does not work anymore, at least on Windows 10 v1903.
    – martixy
    Jul 27, 2019 at 16:26
  • 2
    After a successful educated guess, I discovered the reason it does not work anymore: Defender has a new feature called Tamper Protection. Turning that off allows Defender to be controlled externally - e.g. via this script or group policy.
    – martixy
    Jul 27, 2019 at 16:36
  • "UAC is not a security boundary" -Microsoft. Hence Tamper Protection is and has been just a marketing buzzword, while not actually protecting Defender from being uninstalled / incapacitated / toggled. For example, here's an updated script to toggle it: pastebin.com/hLsCCZQY
    – AveYo
    Feb 12, 2020 at 15:28

It seems you can do this in powershell:

Set-MpPreference -DisableRealtimeMonitoring $true

Obviously, set it to $false to turn it back on.

This answer on StackExchange discusses how to turn this into a shortcut if that's how you choose to proceed.


Just use Local Group Policy Editor to nerf it bad...

I'm so tired of that resource hog that I've made it nice little pet now. and it only scnan anything I ask it to. Like if I download something and I'm not 100% sure about it. I just right click and scan the zip or folder or file with Windows defender. and it will tell me if it's iffi or not.

Windows HAVE begun trying to get back their little spy tool. and are now reporting my policy edits as malware or virus. lol. but they don't do anything. just report it and let me click approve on it. and I can keep my little pet in leech.

You can just as easily enable it again by removing the policies

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .