Real-time protection stops running scans the moment you disable it

Real-time protection is the background scanner that watches files as you download, open, or move them. When you turn it off, your antivirus or security software stops checking new files automatically. Windows Defender (built into Windows), third-party antivirus programs like Norton or McAfee, and Mac's Gatekeeper all work this way. Disabling it is straightforward but leaves your computer unprotected until you turn it back on.

Most people disable real-time protection temporarily — to install software that the scanner keeps blocking, to speed up a slow computer during a specific task, or to troubleshoot a problem. Leaving it off permanently is not recommended, because malware can enter your system without any active scanning to catch it.

Key Takeaways

  • Real-time protection runs in the background and scans files as they arrive; turning it off stops this automatic scanning immediately.
  • On Windows, you disable it through Windows Security settings or your third-party antivirus program's own control panel.
  • On Mac, you manage Gatekeeper through System Settings under Privacy & Security, though built-in protection remains limited.
  • Disabling real-time protection is temporary troubleshooting, not a permanent setting — turn it back on as soon as you finish the task that required it.
  • Some programs block real-time protection from being disabled; you may need to restart in Safe Mode or use administrator access to override it.

How to disable real-time protection on Windows

On Windows 10 and 11, the easiest route is Windows Defender, which is built in. Open the Start menu, type "Windows Security," and press Enter. Click "Virus & threat protection" on the left side. Under "Virus & threat protection settings," click "Manage settings." Toggle off "Real-time protection." Windows will ask you to confirm; click "Yes." The protection stops immediately.

If you use a third-party antivirus program instead — Norton, McAfee, Kaspersky, Bitdefender, or another — open that program's main window. Look for a settings or preferences menu, usually in the top right or left corner. Find the option labeled "Real-time protection," "Active protection," "On-access scanning," or similar. Toggle it off. The exact location varies by program, so check your program's help menu if you cannot find it quickly.

Some antivirus programs prevent you from disabling real-time protection without administrator permission. If you see a lock icon or a message saying you do not have permission, right-click the program and select "Run as administrator," then try again. If the toggle is grayed out and you are already an administrator, restart your computer in Safe Mode with Networking, disable the protection there, and restart normally.

How to disable real-time protection on Mac

Mac does not have a single "real-time protection" toggle the way Windows does. Instead, macOS uses Gatekeeper, which checks downloaded files and apps before you open them. Open System Settings (or System Preferences on older Macs), click "Privacy & Security" on the left, and scroll down to "Security." You will see options for "Allow apps downloaded from" — this controls Gatekeeper. The default is "App Store and identified developers." If you change it to "Anywhere," Gatekeeper stops checking downloaded files.

If you use a third-party antivirus program on Mac — Kaspersky, Norton, McAfee, or another — open that program and look for its settings or preferences. Find the option for real-time scanning or active protection and toggle it off. Some Mac antivirus programs require you to enter your administrator password before you can disable protection.

Macs also run XProtect, Apple's built-in malware scanner that runs in the background. You cannot disable XProtect directly through settings. If you need to stop all background scanning for troubleshooting, restart your Mac in Safe Mode, which disables third-party extensions and reduces background processes, though XProtect still runs.

Why you might need to disable it temporarily

The most common reason is that real-time protection blocks software you are trying to install. Antivirus programs sometimes flag legitimate programs as suspicious because they behave like malware — they modify system files, run in the background, or access sensitive folders. If an installer keeps failing and your antivirus is blocking it, disabling real-time protection during installation can let the program through.

A second reason is performance. Real-time scanning uses CPU and memory, which can slow down older computers or make gaming, video editing, or other resource-heavy tasks stutter. Turning it off during that task can free up resources. A third reason is troubleshooting — if your computer is crashing or freezing, you might disable real-time protection temporarily to see whether the antivirus itself is causing the problem.

In all these cases, the goal is temporary. Once the installation is done, the task is finished, or you have identified the problem, turn real-time protection back on. Leaving it off for days or weeks exposes your computer to malware that could enter without any active scanning to catch it.

How to turn real-time protection back on

On Windows, open Windows Security again, go to "Virus & threat protection," click "Manage settings," and toggle "Real-time protection" back on. The toggle will turn blue and say "On." If you use a third-party antivirus, open that program and toggle the protection back on in its settings.

On Mac, open System Settings, go to "Privacy & Security," and change "Allow apps downloaded from" back to "App Store and identified developers" if you changed it to "Anywhere." If you use a third-party antivirus, open that program and toggle real-time scanning back on.

What happens when real-time protection is off

Your computer stops scanning files as they arrive. If you download a file infected with malware, the antivirus will not catch it automatically. If you plug in a USB drive with infected files, they will not be scanned. If a website tries to download malware to your computer, real-time protection will not block it. The malware can sit on your hard drive undetected until you run a manual scan or turn real-time protection back on.

This is why disabling it is a temporary measure. The longer it stays off, the greater the window for malware to enter your system. If you must disable it for more than an hour or two, consider running a full system scan before you turn it back on, to catch anything that may have slipped through while protection was off.

When you cannot disable real-time protection

Some organizations lock down computers so employees cannot disable security features. If you work on a company computer and the toggle is grayed out or missing, your IT department has restricted it. You will need to contact them to request a temporary exception or to help you troubleshoot the problem that made you want to disable it.

If you own the computer but cannot disable protection even as an administrator, the antivirus program itself may be preventing it. Restart in Safe Mode with Networking (on Windows, hold Shift while restarting and select "Troubleshoot" > "Advanced options" > "Startup Settings"; on Mac, restart and hold Shift). Safe Mode disables many background processes and may allow you to disable protection. If that does not work, you may need to uninstall the antivirus program entirely and reinstall it, or contact the antivirus company's support for help.

Frequently Asked Questions

Will my computer get a virus if I disable real-time protection for an hour?

Not necessarily. The risk depends on what you do during that hour. If you are installing software from a trusted source and not browsing untrusted websites or opening email attachments, the risk is low. If you are downloading files from unknown sources or visiting suspicious websites, the risk is much higher. Real-time protection is your safety net; without it, you are relying on your own judgment to avoid malware.

Can I disable real-time protection just for certain programs?

Most antivirus programs let you add programs or folders to an exclusion list, so real-time protection skips them. This is safer than disabling protection entirely. Open your antivirus settings, look for "Exclusions," "Whitelist," or "Trusted programs," and add the program or folder. Real-time protection stays on for everything else.

Does disabling real-time protection affect manual scans?

No. You can still run a full system scan or scan a specific folder manually, even if real-time protection is off. The manual scan will check files on demand, whereas real-time protection checks them as they arrive. Disabling real-time protection only stops the automatic, background scanning.

Is it safe to disable real-time protection on a Mac?

Mac's built-in protections are less aggressive than Windows Defender or third-party antivirus programs, so disabling Gatekeeper is less risky than disabling Windows protection. However, it still leaves you more vulnerable. If you disable it, do so only for the time you need and turn it back on immediately after.

What if my antivirus program will not let me disable real-time protection?

The program may be designed to prevent accidental disabling, or your computer may be managed by an organization that locks down security settings. Try restarting in Safe Mode and disabling it there. If that does not work, contact your antivirus company's support or, if it is a work computer, contact your IT department.