You may prefer a single-click shortcut or script solution because of the following reasons:<\/p>\n
- \n
- It takes several mouse clicks to turn off\/on the Windows Defender real-time protection through the user interface.<\/li>\n
- The Turn off Microsoft Defender Antivirus<\/strong> Group Policy setting or its equivalent registry setting
DisableAntiSpyware = 1<\/code> would require rebooting the computer.<\/li>\n- Microsoft has discontinued<\/strong> the
DisableAntiSpyware<\/code> policy\/registry setting in Microsoft Defender Antimalware platform versions 4.18.2007.8 and higher.DisableAntiSpyware<\/code> no longer works!<\/li>\n<\/ol>\n![\"hand](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/08\/hand.png\")
This post explains how to enable or disable Windows Defender in a single click using desktop shortcuts or command-line without requiring a restart<\/strong>.<\/p>\n\nContents<\/h4>\n
- \n
- Turn off the Microsoft Defender service completely as TrustedInstaller<\/a><\/li>\n
- PowerShell commands to enable and disable Defender real-time protection<\/a><\/li>\n
- PowerShell Script file to enable and disable Defender real-time protection<\/a><\/li>\n<\/ol>\n<\/div>\n
<\/p>\n
Enable or disable Windows Defender using Shortcut or Command-line<\/h2>\n
<\/a>Method 1: Turn off the Microsoft Defender service completely<\/h3>\n
\nMarch 2022 Update:<\/strong> Method 1 doesn’t seem to work in the latest Windows 10 build 10.0.19044.1586 (21H2) despite running the script as TrustedInstaller. It throws up error 2, which means “The user did not have the necessary access.”<\/p>\nI’ll do more testing and see if a workaround is available.\n<\/p><\/div>\n
This method turns off the Microsoft (Windows) Defender service altogether, which means every component of Windows Defender (including the real-time protection, Microsoft Defender Antivirus Network Inspection Service, cloud-based protection<\/a>, limited periodic scanning<\/a>, tamper protection, controlled folder access<\/a>, etc.,)<\/p>\n
This method works even if the Tamper Protection setting is enabled in the Windows Defender user interface. The Microsoft Defender Antivirus Service can be turned off only by a process running under the
TrustedInstaller<\/code> account.<\/em><\/p>\n- \n
- Download AdvancedRun<\/strong> from the following page at Nirsoft’s site.\n
https:\/\/www.nirsoft.net\/utils\/advanced_run.html<\/pre>\n
(AdvancedRun from Nirsoft is a program that lets you launch apps as TrustedInstaller<\/strong> or LocalSystem<\/a>, as we’ve seen in the article How to Run Programs as TrustedInstaller<\/a>.)<\/em><\/li>\n
- Extract the executable
AdvancedRun.exe<\/code> to a permanent folder — let’s sayD:\\Tools<\/code>.<\/li>\n- Create a Windows script file containing the following lines of code. To create a script file (.vbs), use Notepad.\n
'Description: Script to disable the Microsoft Defender Antivirus service\r\n\r\nSet ServiceSet = GetObject(\"winmgmts:\").ExecQuery _\r\n(\"select * from Win32_Service where Name='WinDefend'\")\r\nFor Each Service In ServiceSet\r\n RetVal = Service.StopService() \r\n If RetVal <> 0 Then \r\n MsgBox \"Error \" & RetVal\r\n End If\r\n Service.ChangeStartMode(\"Manual\")\r\nNext<\/pre>\n<\/li>\n
- Save the script file as
disable_defender.vbs<\/code> in theD:\\Tools<\/code> folder.<\/li>\n- From the Run dialog, run the following command-line to disable Windows Defender altogether:
\n![\"advancedrun](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/advanced-run-command-line-defender.png\")
<\/p>\nD:\\Tools\\AdvancedRun.exe \/EXEFilename \"%windir%\\system32\\wscript.exe\" \/CommandLine '\"D:\\Tools\\disable-defender.vbs\"' \/RunAs 8 \/Run<\/pre>\n
(Optionally, you can create a desktop shortcut to the above command.)<\/em><\/li>\n<\/ol>\n
That disables Microsoft Defender Antivirus Service & Microsoft Defender Antivirus Network Inspection Service.<\/p>\n
![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-turn-off-notification.png\")
<\/p>\n![\"virus](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-disabled-warning.png\")
<\/p>\nYou may also see the following message when opening the Windows Security “Security at a glance<\/a>” page.<\/p>\n
Page not available\r\n\r\nYour IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information.<\/pre>\n
Editor’s note:<\/strong> If your PC is used by multiple users, you also need to make sure that the script file is saved in a secure location so that it can’t be tampered with by other users. Use NTFS permissions accordingly to secure the file.<\/em><\/p>\n
\nHow to Enable and Start Microsoft Defender?<\/h4>\n
To enable and start Microsoft Defender Antivirus Service<\/strong> and Microsoft Defender Antivirus Network Inspection Service<\/strong> back, follow these steps:<\/p>\n
Create another script file named
enable-defender.vbs<\/code> with the following contents:<\/p>\n'Description: Script to enable the Microsoft Defender Antivirus service\r\n\r\nSet ServiceSet = GetObject(\"winmgmts:\").ExecQuery _\r\n(\"select * from Win32_Service where Name='WinDefend'\")\r\nFor Each Service In ServiceSet\r\n Service.ChangeStartMode(\"Automatic\")\r\n RetVal = Service.StartService() \r\n If RetVal <> 0 Then \r\n MsgBox \"Error \" & RetVal\r\n End If\r\nNext<\/pre>\n
Then launch the script as TrustedInstaller, using the following AdvancedRun command-line:<\/p>\n
D:\\Tools\\AdvancedRun.exe \/EXEFilename \"%windir%\\system32\\wscript.exe\" \/CommandLine '\"D:\\Tools\\enable-defender.vbs\"' \/RunAs 8 \/Run<\/pre>\n<\/div>\n
You can create separate desktop shortcuts to the above commands to quickly enable or disable the Microsoft Defender Antivirus service.<\/em><\/p>\n
![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-powershell-shortcuts.png\")
<\/p>\n(An alternative tool\/method to enable\/disable Microsoft Defender is Defender Control <\/strong>app from Sordum.)<\/em><\/p>\n
\n![\"\"](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/information-icon.png\")
Note:<\/strong> Methods 2 and 3 below don’t work if the Tamper Protection<\/strong> feature is enabled in Windows Defender Settings. Tamper Protection<\/a> prevents third-party apps or scripts from modifying Windows Defender settings. The feature was first introduced in Windows 10 v1903 (19H1).<\/p>\n
\n<\/a>Method 2: Shortcuts to enable and disable Defender real-time protection<\/h3>\n
You can disable Windows Defender real-time protection using this PowerShell command:<\/p>\n
powershell.exe -command \"Set-MpPreference -DisableRealtimeMonitoring $true\"<\/pre>\n
After you run the above command from an elevated Command Prompt<\/a> or Run dialog (elevated)<\/a>, it disables the real-time protection component of Windows Defender. Following that, you’ll immediately see the “Virus & threat protection<\/strong>” action center notification.<\/p>\n
<\/p>\n![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-turn-off-shortcut.png\")
<\/p>\nAnd to enable the real-time protection back, use this command-line:<\/p>\n
powershell.exe -command \"Set-MpPreference -DisableRealtimeMonitoring $false\"<\/pre>\n
![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-turn-on-shortcut.png\")
<\/p>\nThe above commands need to be run elevated (run as administrator).<\/p>\n
You can create separate desktop shortcuts to the above commands and run them as required. Make sure you run the shortcut using the Run as administrator<\/strong> option in the right-click menu. Alternately, you can configure the shortcut properties<\/strong> so that they run elevated every time.<\/p>\n
\n<\/a>Method 3: PowerShell script (.ps1) to toggle Defender real-time protection<\/h3>\n
This method uses a simple PowerShell script, which, when run, toggles the Windows Defender real-time protection setting. If it’s turned off, the script turns it back on, and vice versa. So, you’ll need just one shortcut<\/strong> if using this method.<\/p>\n
- \n
- Copy the following lines to Notepad:\n
$preferences = Get-MpPreference\r\nSet-MpPreference -DisableRealtimeMonitoring (!$preferences.DisableRealtimeMonitoring)<\/pre>\n
![\"defender](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/defender-powershell-script-toggle.png\")
<\/li>\n - Save the file with a
.ps1<\/code> extension in a permanent location. Let’s sayd:\\tools\\defender-realtime-toggle.ps1<\/code><\/li>\n- Create a desktop shortcut with the following command:\n
powershell.exe -ExecutionPolicy Bypass -File \"D:\\Tools\\defender-realtime-toggle.ps1\"<\/pre>\n<\/li>\n<\/ol>\n
That’s it! As always, whenever you plan to run the shortcut\/script, you need to run it elevated (run as administrator.)<\/p>\n
\nOther PowerShell cmdlets to manage Windows Defender<\/h4>\n
To know the complete list of PowerShell cmdlets for managing Windows Defender, check out the Microsoft docs article on Defender-specific PowerShell cmdlets<\/a>.<\/em><\/p>\n
We’ve seen PowerShell’s Defender-specific cmdlets earlier in our earlier articles mentioned below:<\/p>\n
- \n
- What is Controlled Folder Access in Windows 10, and How to Configure it?<\/a><\/li>\n
- Enable or Disable “Controlled Folder Access” Quickly Using Shortcuts<\/a><\/li>\n
- How to Enable PUA, PUP, or Adware Protection in Windows Defender?<\/a><\/li>\n
- Windows Defender Offline Scan in Windows 10 Eliminates Complex Malware<\/a><\/li>\n<\/ol>\n<\/div>\n
I hope you liked the shortcut or command-line method to enable and disable Windows Defender real-time protection on your computer.<\/p>\n
- Enable or Disable “Controlled Folder Access” Quickly Using Shortcuts<\/a><\/li>\n
- Create a desktop shortcut with the following command:\n
- Extract the executable
- PowerShell commands to enable and disable Defender real-time protection<\/a><\/li>\n
- Microsoft has discontinued<\/strong> the