How to Completely Disable ‘Windows Defender Application Guard’ via Group Policy in Windows 11

Windows Defender Application Guard (WDAG) is a highly secure virtualization feature in Windows 11 designed to isolate untrusted websites and Microsoft Office files. When a user opens an untrusted link, WDAG spins up a lightweight, hardware-isolated Hyper-V container to run Microsoft Edge. If the site is malicious, the malware is trapped inside the container and destroyed when the browser is closed. While incredibly secure, WDAG requires significant CPU, RAM, and disk resources to maintain these virtualized sandboxes. In environments utilizing thin clients, low-resource legacy hardware, or where third-party Secure Web Gateways (SWG) and EDR solutions already provide comprehensive web filtering, running WDAG is redundant and severely degrades system performance.

This guide explains how to completely disable Windows Defender Application Guard via Group Policy in Windows 11, ensuring the OS does not attempt to utilize Hyper-V containers for browser isolation.

Disable Windows Defender Application Guard via Group Policy

To enforce a strict block that disables the feature globally, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Defender Application Guard

5. In the right-hand pane, locate the policy named Turn on Windows Defender Application Guard in Managed Mode.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled.
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Because WDAG relies on deep integration with Hyper-V and the Windows kernel, Group Policy changes to this component require a full system reboot to cleanly unload the virtualization services.

To enforce the change, open an elevated Command Prompt and execute gpupdate /force, then reboot the workstation. Post-reboot, to verify the restriction is active, attempt to launch an “Application Guard window” from within Microsoft Edge (via the three-dot menu). The option will either be entirely absent or greyed out with a message stating that it is managed by your organization. The system is now freed from the heavy resource overhead of localized web virtualization.