How to Disable Automatic Sample Submission in Windows Defender

Windows Defender is Microsoft's built-in antivirus software that comes pre-installed on Windows 10 and 11 computers. To improve its threat detection capabilities, Defender has a feature called Automatic Sample Submission that uploads suspicious files to Microsoft for analysis. While this can help protect against new threats, some users may have privacy concerns about sharing data. This guide will show you how to disable automatic sample submission in Windows Defender.

By default, Windows Defender only uploads executable files and other program files that it deems suspicious. It will not automatically upload documents or files likely to contain personal information without prompting you first. However, if you want full control over what gets shared, you can turn off automatic submission entirely.

Step 1: Open Windows Security settings. On Windows 11, click the Start button and search for "Windows Security". On Windows 10, right-click the Start button and select "Settings", then click "Update & Security" followed by "Windows Security".

Step 2: In the Windows Security window, click on "Virus & threat protection" in the left sidebar.

Step 3: Scroll down to the "Virus & threat protection settings" section and click "Manage settings".

Step 4: Locate the "Automatic sample submission" toggle switch and click it to turn it Off.

Step 5: You'll see a User Account Control prompt asking for permission to make this change. Click "Yes" to confirm.

After disabling automatic sample submission, you may see a message saying "Automatic sample submission is off. Your device may be vulnerable." This is a standard warning, but your antivirus protection will continue to function.

If you still want the option to manually submit suspicious files to Microsoft for analysis, you can do so by clicking the "Submit a sample manually" link in the Windows Security settings.

Alternative Method: Using Group Policy Editor

For users with Windows 10/11 Pro, Enterprise, or Education editions, there's an alternative method using the Group Policy Editor:

Step 1: Press Windows key + R, type gpedit.msc, and press Enter to open the Group Policy Editor.

Step 2: Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > MAPS.

Step 3: Double-click on "Configure local setting override for reporting to Microsoft MAPS".

Step 4: Select "Enabled" and set the option to "Never send".

Step 5: Click "Apply" and then "OK".

Step 6: Restart your computer for the changes to take effect.

Using PowerShell to Disable Automatic Sample Submission

For advanced users or those who prefer command-line tools, PowerShell offers a quick way to disable automatic sample submission:

Step 1: Open PowerShell as an administrator. You can do this by right-clicking the Start button and selecting "Windows PowerShell (Admin)".

Step 2: Copy and paste the following command into PowerShell:

Set-MpPreference -SubmitSamplesConsent 2

Step 3: Press Enter to execute the command. This sets the sample submission consent to "Never send".

You can verify the change by running:

Get-MpPreference | Select-Object SubmitSamplesConsent

This should return a value of 2, indicating that automatic sample submission is disabled.

Disabling automatic sample submission gives you more control over your data, but it's important to remember that this feature helps Microsoft improve Windows Defender's ability to detect new threats. If you're concerned about specific files, consider using the manual submission option instead of turning off the feature entirely. Keep your system and Windows Defender updated regularly to maintain strong protection against malware and viruses.