When Defender Becomes a Hindrance
Microsoft Defender (formerly Windows Defender) is an excellent, built-in antivirus engine that provides robust real-time protection for the Windows operating system. However, in specific enterprise scenarios, it must be temporarily disabled. If a system administrator is installing a massive third-party software suite, deploying a custom compiled application that falsely triggers the heuristic scanner, or attempting to install a specialized enterprise EDR (Endpoint Detection and Response) solution like CrowdStrike, Defender’s real-time protection will aggressively block the installation files.
While you can navigate deep into the Windows Security GUI to toggle the switch, PowerShell allows you to disable real-time protection instantly, making it ideal for automated deployment scripts.
Using the Set-MpPreference Cmdlet
PowerShell includes a dedicated module (Defender) for managing all antivirus settings. The core cmdlet for modifying these settings is Set-MpPreference.
Because you are attempting to disable core security infrastructure, you must run this command from an elevated PowerShell prompt (Run as Administrator).
Execute the following command:
Set-MpPreference -DisableRealtimeMonitoring $trueThe command will execute silently. There is no confirmation output. The moment you press enter, Windows Defender will stop scanning files as they are written to the hard drive or executed in memory.
If you have the Windows Security dashboard open, you will instantly see a red warning banner appear, stating that real-time protection is turned off and the device is vulnerable.
Tamper Protection Roadblocks
If you run the Set-MpPreference command and it returns a stark red “Access Denied” or “Permission Denied” error, despite running PowerShell as an Administrator, you have encountered Tamper Protection.
Tamper Protection is a security feature designed to prevent malware (or rogue scripts) from disabling the antivirus. If Tamper Protection is enabled in the Windows Security GUI, or enforced via Microsoft Intune / Group Policy, the PowerShell command will completely fail.
In this scenario, you cannot disable real-time protection via the command line. You must physically open the Windows Security app, go to Virus & threat protection settings, and manually toggle Tamper Protection to “Off” before your PowerShell script will work.
Re-Enabling Real-Time Protection
Once your software installation or debugging session is complete, you must immediately re-enable real-time protection to secure the workstation.
Do not rely on a reboot to fix this. While Windows 11 will eventually turn real-time protection back on automatically after a certain period of time, relying on this timer leaves your system exposed.
To instantly re-enable the scanner, run the same command, but set the boolean value to $false.
Set-MpPreference -DisableRealtimeMonitoring $falseThe red warning banner in the Security dashboard will disappear, and the background scanning engine will immediately resume protecting the operating system.