Set-MpPreference in Windows Defender in Windows 11/10

If you’ve been looking for a way to change Microsoft Defender preferences in Windows, you may have come across the Set-MpPreference PowerShell command. This command lets you view and configure several settings related to Microsoft Defender Antivirus, including real-time protection, scheduled scans, cloud protection, and threat handling.

The term Set-MpPreference is a PowerShell command, not a setting you’ll usually find as a button in the Windows Security app. It’s designed for users who want more control over Microsoft Defender through commands instead of navigating multiple menus.

In this guide, you’ll learn how to use Set-MpPreference in Windows 11 and Windows 10, open PowerShell with the correct permissions, change selected antivirus preferences, and verify your settings safely. 

Let’s learn everything in detail!

What Set-MpPreference Does?

Before entering commands, it’s helpful to understand what Set-MpPreference actually changes.

Microsoft Defender Antivirus includes several configurable preferences. These control how the antivirus engine monitors files, checks suspicious activity, uses cloud protection, and performs scans. The Set-MpPreference cmdlet lets you change supported preferences through PowerShell.

For example, you can use it to request that real-time protection stay enabled, adjust scheduled scan settings, or configure cloud protection. The exact options available depend on your Windows version, Defender configuration, and permissions.

Keep in mind that Set-MpPreference doesn’t replace Windows Defender. It changes selected settings within Microsoft Defender Antivirus.

You should also avoid copying commands from unfamiliar websites without understanding what they do. Some commands can turn off important protections or change how Defender responds to threats. 

For routine use, keep real-time protection and cloud-delivered protection enabled unless you have a specific, well-understood reason to change them.

How to Use Set-MpPreference in Windows Defender

To use Set-MpPreference in Windows 11 or Windows 10, open PowerShell as an administrator, enter the appropriate Set-MpPreference command, and press Enter. For example, Set-MpPreference -DisableRealtimeMonitoring $false requests that real-time monitoring remain enabled. Check the result with Get-MpComputerStatus or Get-MpPreference. 

Some settings may be controlled by organizational policies, tamper protection, or other security management tools.

Step 1: Open PowerShell as an Administrator

To change many Microsoft Defender preferences, you’ll need an elevated PowerShell session. This means opening PowerShell with administrator permissions.

In Windows 11, click the Start button and type PowerShell in the search box. When Windows PowerShell or PowerShell appears in the results, right-click it and select Run as administrator. If prompted by User Account Control, select Yes if you trust the application you opened.

In Windows 10, open the Start menu, type PowerShell, right-click the result, and choose Run as administrator.

A PowerShell window will open. Its title may indicate that it is running as an administrator. You can now enter commands to inspect or configure Defender preferences.

If your account doesn’t have administrator permissions, you may need assistance from the person who manages your computer. On a work or school device, some settings may be controlled by your IT administrator.

Step 2: Check Your Microsoft Defender Status

Before changing any preference, check whether Microsoft Defender Antivirus is active and what protection status your computer reports.

In the administrator PowerShell window, enter this command:

Get-MpComputerStatus

Press Enter and wait for the results. PowerShell will display various status values, including information about antivirus protection, real-time protection, and security intelligence.

Look for the AntivirusEnabled and RealTimeProtectionEnabled values. When the relevant protection is active, these values should generally show True.

You can also check your current preferences by entering:

Get-MpPreference

This command displays a large collection of Defender configuration values. You don’t need to understand every line. The purpose is to establish a baseline before you make changes.

If Microsoft Defender is managed by another antivirus product, organizational policy, or a security management system, some settings may behave differently. Don’t assume that a command has failed simply because the displayed value doesn’t change as expected.

Step 3: Use Set-MpPreference to Keep Real-Time Protection Enabled

Real-time protection helps Microsoft Defender examine files and activities as they occur. Keeping this feature enabled is important for everyday security.

To request that real-time monitoring remain enabled, enter the following command in administrator PowerShell:

Set-MpPreference -DisableRealtimeMonitoring $false

Press Enter to run it.

Notice the word Disable in the parameter name. Setting -DisableRealtimeMonitoring to $false means you’re asking Defender not to disable real-time monitoring. PowerShell uses $false and $true as Boolean values, which represent false and true.

This command may not override organizational policies or other controls. If the setting is managed, Windows may prevent the change or restore the required configuration.

To check the current status, run:

Get-MpComputerStatus

Look for RealTimeProtectionEnabled. If it reports True, real-time protection is currently enabled according to the reported status.

Step 4: Configure Cloud-Delivered Protection

Microsoft Defender can use cloud-delivered protection to help identify suspicious files and emerging threats. This feature can provide additional protection when local detection information alone isn’t enough.

To request that cloud-delivered protection remain enabled, run:

Set-MpPreference -MAPSReporting Advanced

The MAPSReporting parameter controls reporting participation in Microsoft’s protection service. The Advanced value enables a higher level of reporting than the basic option, but its availability and implications should be reviewed before use.

Because reporting settings can affect information sent to Microsoft, don’t change them casually. If you prefer not to adjust reporting, you can leave your existing configuration unchanged and review cloud protection through Windows Security > Virus & threat protection > Manage settings.

Depending on the Windows version and policy configuration, related settings may be controlled separately. Avoid assuming that changing one reporting parameter automatically configures every cloud protection option.

Step 5: View and Configure Other Defender Preferences

The Get-MpPreference command is useful when you want to inspect settings before changing them. Enter:

Get-MpPreference

PowerShell will show supported preferences, including settings related to scans, exclusions, and threat handling. Some values may be empty, set to defaults, or controlled by policy.

If you want to inspect a particular setting without displaying the entire list, you can use a command such as:

(Get-MpPreference).DisableRealtimeMonitoring

This example displays the configured value for the real-time monitoring disable parameter. A value of False means that the preference is not set to disable real-time monitoring, although you should also check the actual protection status.

Before changing any other preference, consult the official Microsoft documentation for the exact parameter and accepted values. Don’t guess parameter names or copy commands that add broad antivirus exclusions. Exclusions can prevent Defender from scanning files or folders and may leave your PC less protected.

Step 6: Verify That Your Changes Worked

After running a Set-MpPreference command, check the relevant setting rather than assuming the change was applied.

For real-time protection, run:

Get-MpComputerStatus

For the current configuration, run:

Get-MpPreference

Compare the relevant value with the status you checked earlier. Some changes take effect immediately, while others may require additional steps or may be blocked by policy.

If PowerShell displays an access-denied error, confirm that you opened the window as an administrator. If the command is not recognized, check that you’re using a Windows PowerShell environment with the Microsoft Defender module available.

If a setting refuses to change, check whether your computer is managed by an organization or whether another security product affects Defender’s operation. 

Avoid disabling security controls simply to force a command to work.

Troubleshoot Set-MpPreference Errors

If Set-MpPreference returns an error, read the message carefully. It may indicate insufficient permissions, an unsupported parameter, a policy restriction, or a problem with the Defender module.

First, close the current PowerShell window. Reopen PowerShell as an administrator and try the command again, making sure the parameter spelling and value are correct.

Next, check your Windows version and Microsoft Defender status. If your computer is managed by a company or school, contact the administrator before attempting to change protected settings.

You can also open Windows Security from the Start menu and select Virus & threat protection to review the current protection status. If Defender reports a problem, follow the recommended recovery steps shown in Windows Security.

Don’t download unofficial scripts or run commands that disable antivirus protection just to bypass an error. 

If the issue continues, use Microsoft’s documentation or your computer manufacturer’s support resources to identify the cause.

FAQs

1. What is Set-MpPreference in Windows Defender?

Set-MpPreference is a PowerShell cmdlet that configures supported Microsoft Defender Antivirus preferences, including selected protection and scan settings.

2. Do I need administrator access to use Set-MpPreference?

Many changes require an administrator PowerShell session. Some settings may still be restricted by organizational policies or other security controls.

3. How do I check my current Defender preferences?

Open PowerShell and run Get-MpPreference. To review protection status, use Get-MpComputerStatus.

4. Can Set-MpPreference turn off real-time protection?

It can configure the related preference, subject to Windows security controls and policy. However, turning off real-time protection can leave your computer more vulnerable, so keep it enabled for normal use.

5. Why isn’t my Set-MpPreference command working?

Common reasons include missing administrator permissions, an unsupported parameter, a managed device policy, or Defender configuration issues. Check the exact error message and confirm the command syntax.

Summary

The Set-MpPreference cmdlet gives you a PowerShell-based way to configure supported Microsoft Defender Antivirus preferences in Windows 11 and Windows 10. Start by opening PowerShell as an administrator, checking your current status with Get-MpComputerStatus, and reviewing preferences with Get-MpPreference.

When making changes, use only parameters you understand and verify the results afterward. Keep important protections, especially real-time protection and cloud-delivered protection, enabled for everyday use. 

If a preference is managed by your organization or Windows refuses the change, investigate the restriction instead of trying to bypass it.