Shadow Defender: Reboot and Every Change Is Gone
Shadow Defender is a $39 Windows utility, sold as a one-time lifetime license, that runs your drives in "Shadow Mode" and throws away every change when you reboot. It suits people who test software, open risky files or share a PC and want a clean system after every restart. Its latest release, version 1.5.0.726, dates from August 2020, and current Windows 11 builds can block its installer, so read the "Before you buy" note first.
Picture a family PC that ends every week with new toolbars, a mystery program in the tray and settings nobody remembers changing. With Shadow Defender, all of that lives in a temporary layer. You restart, and the PC is back to the state you froze it in.
Quick facts
- Version: 1.5.0.726, released August 2020 (no release since)
- Developer: ShadowDefender.com, a one-person developer according to long-time users
- Runs on: Windows XP to Windows 11 according to the developer (see the Windows 11 note below). No Mac or Linux version
- What it does: virtualizes whole volumes so all writes go to a temporary layer that is discarded on reboot
- Price: $39.00 for one lifetime license, with free updates. Volume discounts down to $18 per license
- Trial: 30 days, full function, then it needs a serial number
- Guarantee: 30-day money-back guarantee badge on the developer's purchase page
- Installer: 3.54 MB
- What we checked: the developer's installer (version 1.5.0.726, 3.54 MB, digitally signed) downloaded on November 2, 2026, and the price of $39.00 on the order page on November 2, 2026. We didn't install it or test it on Windows 11 24H2.
Before you buy: check your Windows version
Shadow Defender hasn't been updated since August 2020. Its download page lists Windows 11, but users on the MalwareTips forum reported from October 2024 that the standard installer is blocked by Windows' compatibility check on Windows 11 24H2, and later on fully updated Windows 11 23H2 and Windows 10 22H2 too. Users also report blue screens on Windows 11 when Core isolation (Memory integrity) is turned on, so it has to be switched off, which weakens one of Windows' own protections. Forum members have posted ways to force the install, and their authors themselves don't recommend them.
If you're on Windows 10 or an older Windows 11 build where it already runs, it still works for many people. If you're on Windows 11 24H2 or later, use the 30-day trial to see whether it installs at all before you pay.
Download Free TrialBuy Now
Overview
Shadow Defender belongs to a small family of "reboot to restore" or light virtualization tools. You pick one or more volumes and put them into Shadow Mode. From then on you still see and use every file on the disk, but each write goes to a virtual layer instead of the real disk. Downloads, installed programs, registry edits and anything malware drops all land in that layer. When you exit Shadow Mode, you choose to discard the lot or commit it, and a reboot of the system drive wipes it.
The program is small and plain. Its window has six pages down the left side: System Status, Mode Setting, Exclusion List, Commit Now, Administration and About. The developer's screenshots show the same layout from the Windows 7 era, and that's essentially the interface you get.
Features
Shadow Mode for any volume you choose
Shadow Defender's Mode Setting page lists every volume with its file system, capacity and current status, and you tick the ones to protect: just C:, or C: plus a data drive. Each one can exit Shadow Mode at shutdown (a one-off session) or enter Shadow Mode on boot, so every Windows start begins from the same frozen state. A Schedule button sets which volumes go into Shadow Mode at boot, and removable drives can be shadowed too.
Exclusion List for files that must survive
Shadow Defender's Exclusion List lets you name files and folders that always write straight to the real disk, such as your Documents folder or a mail store, so your work survives a reboot while the rest of the system resets. Registry keys can be excluded as well, including items under HKEY_CURRENT_USER and, since 2016, HKEY_LOCAL_MACHINE\SAM and \Security.
Commit Now, including a right-click option
Shadow Defender's Commit Now saves a chosen file or folder to the real disk once, on demand, without excluding it for good. You add items on the Commit Now page and click Apply, or right-click a file in Explorer and pick Commit by Shadow Defender. If the file changes again afterwards, you have to commit it again.
RAM write cache and boot-sector protection
Shadow Defender can use a set amount of RAM as a write cache, which speeds up disk access in Shadow Mode and spills over to disk when it fills. The cache has been encrypted since 2013 (AES since version 1.4.0.672). The change history also lists MBR protection, Track 0 virtualization, automatic shadowing of the hidden boot volume, and SSD support with TRIM handling.
Administration: password, tray icon and low-space warning
Shadow Defender's Administration page has switches for starting with Windows, the tray icon, a desktop tip that reminds you Shadow Mode is on, the Explorer context-menu entry, password control (optionally also for committing files from the context menu), and a warning when the protected volume runs low on free space. For rollouts, the installer accepts /silent and /config: switches, and a command-line tool has been included since 2013.
Benefits
The main benefit is a known-good PC after every restart without waiting for a backup to restore. Undoing a bad install takes one reboot, not an hour with an image tool. It also costs almost nothing to run: dotTech measured roughly 5 MB of RAM in its 2013 review. And because the license is lifetime, there's no subscription to renew.
It isn't an antivirus. Malware that runs inside a Shadow Mode session can still read your files, log keystrokes or send data out until you reboot. It only guarantees that the changes don't stay.
Real-World Uses
- Trying out software: install a trial or a game, use it, reboot, and no leftover services, files or registry keys remain.
- Opening a suspicious attachment or download: enter Shadow Mode first, with an antivirus running, and whatever the file changes disappears on restart.
- Shared or public PCs: a family computer, a classroom or a reception desk PC set to enter Shadow Mode on boot comes back clean each morning, with a password so users can't turn it off.
- Testing settings tweaks: change system settings or run a "cleaner" in Shadow Mode, keep the result only if you like it by committing all changes when you exit.
Who It's For, and Who Should Skip It
Shadow Defender fits Windows 10 users and anyone on an older Windows 11 build where it already installs, who want a simple, one-time-purchase way to undo everything on reboot. It also suits small offices and schools that need a few dozen protected PCs and like the volume pricing.
Skip it if you're on Windows 11 24H2 or later and don't want to switch off Memory integrity or work around the installer block. Skip it too if you need several restore points to go back to (a snapshot tool such as RollBack Rx does that), if you manage many PCs and want a vendor that ships updates and answers support (Faronics Deep Freeze is the usual choice), or if you only want to run one untrusted program at a time, which Windows Sandbox on Windows Pro editions handles for free.
Usage Guide
- Install: run Setup.exe, accept the license, enter your name and organization, finish, and reboot. If you use a third-party antivirus, a MalwareTips user recommends installing it before Shadow Defender.
- Open it: Start > Programs > Shadow Defender. The System Status page shows a pie chart of used and free space for each volume, its current mode and how much space Shadow Defender is using.
- Set exclusions first: on the Exclusion List page, add the folders that must keep their changes, such as Documents or your browser profile, and click Apply.
- Enter Shadow Mode: on Mode Setting, tick the volumes, optionally set RAM for the write cache, click Enter Shadow Mode, and choose Exit Shadow Mode when shutdown or Enter Shadow Mode on boot.
- Save something mid-session: right-click it and choose Commit by Shadow Defender.
- Exit: select the volume and click Exit Shadow Mode, then choose Discard all changes except Exclusion List or Commit all changes. The system volume needs a reboot to exit.
- Register: click Register in the main window and paste the serial number from your order email.
Tip: turn off Fast Startup
If changes survive a shutdown but vanish after a restart, Windows' Fast Startup is the reason. It is on by default in Windows 8, 10 and 11 and hibernates instead of shutting down, so Shadow Mode never ends. The developer's FAQ says to disable Fast Startup so a shutdown discards changes too.
Where it falls short
- Updates are lost too. Windows updates and antivirus definitions installed in Shadow Mode disappear on reboot, so you have to exit Shadow Mode now and then to let them stick.
- No warning before a reboot. dotTech's review points out there's no prompt reminding you that changes will be lost, only the optional desktop tip. Forgetting it's on is a common complaint.
- Only one baseline. You can return to the state you froze, not to last Tuesday.
- It doesn't stop data theft. Malware still runs normally until the reboot.
- Conflicts with other low-level tools. Users report it can't share a PC with RollBack Rx (both use the boot record), and a 2014 MalwareTips user ended up stuck in Safe Mode after another security tool's lockdown mode. A 2015 reviewer saw the RAM write cache misbehave on some AMD and low-RAM systems.
- Support. Support is by email only, from a one-person developer whose release history has had gaps of more than a year. The website itself was offline for about two months in 2024.
What Users Say
Shadow Defender has no ratings on Trustpilot, Capterra or G2. Its reviews live on security forums, where it has a loyal following, and in a few older tech-site reviews. The praise is about how reliable and simple it is. The recent complaints are about Windows 11 compatibility and the lack of updates.
dotTech review (May 1, 2013)
dotTech's staff review tested the program and liked it, with one big reservation about updates:
"Overall, Shadow Defender is a very good light virtualization program that will protect you from unwanted changes and malware/viruses/trojans/rootkits/etc." Among its pros: "Lightweight (uses roughly 5 MB of RAM and minimal CPU while it is turned on)".
Among its cons: "Does not display any sort of prompt prior to reboot/shutdown that reminds users all changes will be lost if/when the computer is shutdown or restarted." and "Developer of Shadow Defender has a sporadic history of issuing updates." The reviewer said he'd rather buy Sandboxie, which was then updated more often.
MalwareTips forum: long-time users
hjlbx (mini-review, March 2015): "On my system Shadow Defender is extremely reliable and handy. It's the best software that I use. Bottom line... this one is a "must-have" in my experience." The same review lists the cons "One-man development team ("Tony" - China); slow development." and "Use RAM for Write Cache may malfunction on AMD and/or low-RAM systems.", and warns: "If any malware is permitted to run while in Shadow Mode, then the entire Shadow Mode\virtualized session is infected ! Data may be stolen !"
Lightning_Brian (November 2018): "I personally would recommend SD all day any day for normal users. However, RX would be good for testers as others have said. Big upside or bonus to SD is a one time payment!"
Sorrento (March 2022): "Used Shadow for some years, I've never had an issue with it, now on windows 11 - The only problems I've actually had are when I've forgotten Shadow was still running & wondered why changes I've made to PC have haven't stuck"
pvsurfer (August 2024): "in my 10 years of using SD it has never failed (after a system restart) to remove anything and everything that was introduced to my system while in Shadow Mode!"
MalwareTips forum: Windows 11 problems
gotch72 (May 2024): "Shadow defender does work fine with Windows 11 latest build as of May 2024 you just need to disable Core isolation from Windows security Centre. I would recommend doing so before installing Shadow defender if not you will get the Bsod and windows crash."
cartaphilus (August 2024): "It BSOD my win 11 without a way around it until you recover earlier backup or reinstall fresh windows."
Digmor Crusher (August 2024): "Actually it gave me bsod's too, it worked well for me for years but about 2 years ago the bsod's started."
Andy Ful (October 2024): "But indeed, SD does not work on Windows 11 24H2 in my Virtual Machine." Two weeks later: "After the latest update, the compatibility alert is also on Windows 10 22H2. So, it seems that SD can no longer be installed via the standard installer on updated Windows."
franz (October 2024), on an existing install: "I have Windows 10 22H2 home with SD, and it works like always."
Viking (August 2025): "It has now been exactly 5 years since Shadow Defender was last updated. One of my favourite piece of software, so useful & handy to use."
The pattern is clear. People who use it love how simple and dependable it is, and many have run it for a decade. Since 2024, though, the reports are about installers blocked on new Windows builds and blue screens with Memory integrity on.
Comparisons
Shadow Defender vs RollBack Rx
RollBack Rx takes snapshots you can return to, while Shadow Defender keeps a single baseline. As MalwareTips user Thirio put it in 2018: "RollBack RX gives you more flexibility with it's unlimited snapshots, while SD and Reboot Restore have only a baseline which they can revert changes to." RollBack Rx suits testers who need to go back days. Shadow Defender suits people who want every session to start clean.
Shadow Defender vs Deep Freeze and Reboot Restore Rx
Faronics Deep Freeze and Reboot Restore Rx do the same reboot-to-restore job. MalwareTips users in 2024 and 2025 named Deep Freeze as the option that keeps up with Windows 11, with one user reporting that Deep Freeze 9.x works on 24H2 while 8.x didn't. Shadow Defender's advantages are its low price, the lifetime license and the per-volume choice with exclusions and commit.
Shadow Defender vs Windows' own tools
Windows Sandbox (Pro and Enterprise editions) runs one throwaway desktop for testing a program, and the Unified Write Filter in Windows Enterprise and Education protects whole volumes the way Shadow Defender does. Both come with Windows, but neither is available on Windows Home.
Editions and Pricing
There's one edition. Every license is lifetime, with free updates and email support, and the price per license drops as you buy more:
| Licenses | Price per license |
|---|
| 1 | $39 |
| 2-4 | $36 |
| 5-9 | $33 |
| 10-49 | $30 |
| 50-99 | $27 |
| 100-199 | $24 |
| 200-299 | $21 |
| 300 or more | $18 |
Payment goes through Avangate (2Checkout), which accepts credit cards, PayPal, bank transfer and purchase orders, and the serial number arrives by email right after the order.
FAQs
Does Shadow Defender work on Windows 11 24H2 or 25H2?
Shadow Defender's standard installer is blocked by Windows' compatibility check on Windows 11 24H2 and later builds, according to several MalwareTips users from October 2024. Forum workarounds exist, but even their authors advise against them. Try the 30-day trial on your own PC before buying.
Do I have to turn off Memory integrity to use Shadow Defender?
On Windows 11, users report that Shadow Defender causes blue screens with Core isolation's Memory integrity switched on, and turning it off before installing fixed it for some of them. That trades away a Windows security feature, which is worth weighing before you buy.
Is Shadow Defender a subscription?
No. Shadow Defender is a one-time purchase: the developer says registered users get a lifetime license with free updates and upgrades.
Can Shadow Defender replace my antivirus?
No. Shadow Defender removes what malware changed once you reboot, but anything running in the session can still steal data until then. Long-time users run it alongside an antivirus and a firewall.
How do I install Windows updates with Shadow Defender running?
Exit Shadow Mode on the system volume (it needs a reboot), let Windows Update and your antivirus update, then enter Shadow Mode again. Updates installed during a Shadow Mode session are discarded like any other change.
Can Shadow Defender be deployed silently on many PCs?
Yes. Shadow Defender's installer accepts /silent and /config:<path-to-config-file>, for example Setup.exe /silent /config:"C:\config.txt", and a command-line tool controls it after install. Volume licenses go down to $18 each.
Can I use Shadow Defender and RollBack Rx together?
Not reliably. A MalwareTips user who tried both said they clash because both use the Master Boot Record. Pick one.
Is there a Mac version of Shadow Defender?
No. Shadow Defender is Windows-only.
System Requirements
- Windows: 11, 10, 8 and 8.1, 7 SP1 (with update KB3033929), Vista SP2 (with KB2763674), Server 2003 and XP, per the download page (see the Windows 11 24H2 note above)
- CPU and RAM: Pentium 133 MHz and 128 MB RAM minimum, per the manual
- Disk: about 3 MB for the program, plus at least 10 MB free on each volume in Shadow Mode. Changes made in Shadow Mode use free space until you reboot
- Languages: English, with community language files (German, French, Spanish, Russian, Chinese and more) on the download page
Conclusion
Shadow Defender is still one of the simplest ways to make a Windows PC forget everything on reboot, and $39 once, with no subscription, is cheap for that. If it installs and runs on your PC, it's worth it for software testing, risky downloads and shared family or classroom computers.
The reason not to buy is just as clear: there has been no release since August 2020, and on Windows 11 24H2 and later the installer is blocked and Memory integrity has to go. If you're on a current Windows 11 build, an actively maintained tool like Deep Freeze is the safer choice. Either way, use the 30-day trial before you pay.
Download Free TrialBuy Now