I wish to disable Windows Defender on Windows 10 Pro, and I know I have to enable the policy Turn off Windows Defender Antivirus via:

  • Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus

This didn't work; Windows Defender, and it's modules, remained active.

  • I tried disabling it via the Registry, adding the following key with a value of 1, but received Error while renaming:
    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
    I restarted my PC several times, turned it off, unplugged it, all to no avail.

Has Microsoft changed something in the latest release that prevents users from turning Windows Defender off?


I found the solution. It turns out that Windows Defender is so ingrained within Windows 10 that it comes with its own "anti-tamper" protection.

This does two things: prevents you from creating the registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender by giving you a generic error message and also renders the group policy change ineffective.

In order to disable this, I had to follow these instructions:

  1. Go to Virus & threat protection
  2. Click on Manage Settings
  3. Turn off Tamper Protection
  4. Proceed to enable the group policy Turn off Windows Defender Antivirus in Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus or add the registry key.
  5. Restart PC
  • Note: Some versions of W10 do not have group policy editor, in this case you will have to edit the registry manually. – Moab Nov 10 '19 at 13:57

Another method. Go to Settings, Security, Virus & threat protection, Manage settings, Tamper protection. Set to Off. Then add this:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]

Tested with Windows 10 version 1909

  • I think it must be a problem with Windows 10 2004 then. I even renamed Windows Defender's folder using a live CD, still it worked just fine. Later I found out windows has, under the SysWOW64 dir, a bunch of tasks that will reactivate every defender server each reboot, regardless of whether I disable if via gpedit, registry or the switches in the windows defender menu. I've done all that with the anti-tamper disabled, to no effect. Ultimately, there's no way to disable it in Windows 10 2004 – Ezequiel Barbosa Aug 21 '20 at 16:00
  • My solution to the problem ended up being to boot into a live CD again and rename all Windows defender folders under C:/Windows/winsxs AS WELL as the folder under C:/Program Files/, that effectively disable it but still I get warnings telling me to enable it again. – Ezequiel Barbosa Aug 21 '20 at 16:02
  • @EzequielBarbosa I would post a new issue naming 2004 specifically - hopefully someone can address the issue – Steven Penny Aug 21 '20 at 16:10
  • It's a good idea but I'm not doing it, I don't have much time and I solved the issue anyways, so. – Ezequiel Barbosa Aug 21 '20 at 16:31

As of Windows 10 version 2004, the group policy location has moved:

  1. turn off tamper protection through defender settings in Windows Settings
  2. Open group policy editor
  3. Navigate to Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus
  4. Turn off defender antivirus

Should work. Note it's now named Microsoft Defender Antivirus rather than Windows Defender now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.