Privacy and Security Enable or Disable Microsoft Defender Antivirus in Windows 11

unifex · Jan 29, 2022

Great tutorial, as always! I have one question though - for a long time now I've been using ESET Internet Security which comes with both the antivirus and firewall. Once this is installed, Windows Defender "lays low" - it's not disabled, but it also appears to do nothing - there are no pop-ups, notifications, etc., but the Windows Defender Firewall service is running. I assume that disabling Defender per this tutorial will also turn off that service. Is there any downside to that? Is this service necessary when a third-party firewall is being used?

Brink · Jan 29, 2022

unifex said:
Great tutorial, as always! I have one question though - for a long time now I've been using ESET Internet Security which comes with both the antivirus and firewall. Once this is installed, Windows Defender "lays low" - it's not disabled, but it also appears to do nothing - there are no pop-ups, notifications, etc., but the Windows Defender Firewall service is running. I assume that disabling Defender per this tutorial will also turn off that service. Is there any downside to that? Is this service necessary when a third-party firewall is being used?

Hello mate, :)

This will not affect Windows Defender Firewall. Only Microsoft Defender Antivirus. I wouldn't recommend to disable Windows Defender Firewall. The extra security is good to have, and will not hurt anything.

unifex · Jan 29, 2022

Thanks @Brink!

Refaus · Feb 12, 2023

~~The Group Policy option doesn't work in Windows 11 22H2. Turn off Microsoft Defender Antivirus reverts to "Not Configured" after a restart.~~
It works now. I had to toggle tamper protection on and off again.

Refaus · Mar 3, 2023

Looks like I spoke too soon. This setting just doesn't stick. After some time, it reverts to "Not Configured" and I see Windows Defender being enabled again.

And no, it's not caused by any updates. This is a fully offline PC.

Refaus · Mar 4, 2023

I also tried the registry option and it didn't work permanently either. It worked at first, it survived a few restarts/shutdowns too. But after some time, it didn't anymore. And the registry entry was deleted.

This is with 22H2 Education edition. As I said the system is offline, it's never been connected to the internet.

I saw other people elsewhere reporting the same, these settings don't work permanently in W11, even though they did in W10.
I suggest you test this again, you can do it in a VM perhaps. And if these settings don't stick, it's better to edit/remove this tutorial, because otherwise it's misleading.

Brink · Mar 4, 2023

Refaus said:
I also tried the registry option and it didn't work permanently either. It worked at first, it survived a few restarts/shutdowns too. But after some time, it didn't anymore. And the registry entry was deleted.

This is with 22H2 Education edition. As I said the system is offline, it's never been connected to the internet.

I saw other people elsewhere reporting the same, these settings don't work permanently in W11, even though they did in W10.
I suggest you test this again, you can do it in a VM perhaps. And if these settings don't stick, it's better to edit/remove this tutorial, because otherwise it's misleading.

The problem is we never can fully track down what is re-enabling it despite being disable by group policy.

TairikuOkami · Mar 4, 2023

Refaus said:
I also tried the registry option and it didn't work permanently either.

There is a grace period since people tend to forget to enable it back, other AVs are set like that too.
You can disable it's services to keep it off, but you might need to install 3rd party AV to be able to do it.

Code:

reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

ThrashZone · Mar 4, 2023

Hi,
Here's the code I use from W1zzard on TPU

Code:

rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f

Windows 11 Tweaks for GPU Benchmark

Updated for 22H2 - Install without Internet - When it prompts you to go online, press Shift+F10 and type "OOBE\BYPASSNRO" (that's an o not a zero at the end). After the automatic reboot you can install without network - Install on systems without TPM, UEFI or other requirements...

www.techpowerup.com

Wisewiz · Mar 4, 2023

I have had nothing but good results from using Windows Defender Control (freeware) from Sordum. Getting it installed is challenging, because its sole reason for existence is to stop (and restart) Defender, and Defender objects to a program that can do that. I had to set up an exception in Defender, and then Malwarebytes Premium grabbed it, and I had to set up an exception in that. Since then, it works perfectly as advertised, and I use it once a month or so, in conjunction with Disk Cleanup. It makes possible the significant cleanup of the Defender's history (from, say, 30MB to a few bytes), and then it responds (always, to date) to my request to turn on WD again. When I start the WD Control utility, I use its shortcut to Defender's Tamper Protection panel, click that off, and then disable Defender for a few moments while I run the cleanup function of Disk Cleanup. Then I enable WD with WD Control and finally turn on Tamper Protection.

When I run a quick scan with Defender, it always reports that it has skipped the WD Control folder. Right.

Privacy and Security Enable or Disable Microsoft Defender Antivirus in Windows 11

Enable or Disable Microsoft Defender Antivirus in Local Group Policy Editor

Enable or Disable Microsoft Defender Antivirus using REG file

Attachments

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Administrator

My Computers

Brony

Attachments

My Computer

Minor Threat

My Computer

Speaks Ancient Geek

My Computers

Similar Windows 11 Tutorials