Has anyone found a way to disable Windows Defender in Windows 11 ?

Install free 3rd party a/v and turn off its realtime protection temporarily as required. Does that do it?

SIW2 said:

Install free 3rd party a/v and turn off its realtime protection temporarily as required. Does that do it?

Click to expand...

Hard to say, I think Windows 10 Dev managed to turn on Defender once, even though it's services where disabled.
I do not need AV, I keep Panda as Defender's disabler. It is easier and it helps to avoid BSOD critical service died.

Hi there
works for me OK (on W11 Enterprise -- released version not the "leaked one" -- just go into settings-->security

same as for standard W10 etc. It's just the settings options are stupidly arranged in W11 -- just search on windows defender or security.





Seems to do the trick

Re-enabled it again of course.

Cheers
jimbo

Found on github (not English) script
I don't have Windows 11 to test.

"In Windows 11, group policies no longer work, you have to forcibly disable the defender service to disable it."


devxexec.exe /user:SYSTEM Script.bat

devxexec.exe :

Start as Admin :

devxexec.exe /user:SYSTEM Script.bat

Script.bat :

@echo off
echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService [1] >> %TEMP%\reg_perm.LOG
regini "%TEMP%/reg_perm.LOG"
del %TEMP%\reg_perm.LOG /q

:nashalo
Echo ============ Choose: ============
Echo Off Windows Defender - 0
Echo On Windows Defender - 1
Set /p vibor="Number: "

if "%vibor%"=="0" (
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 4 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
) else if "%vibor%"=="1" (
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 2 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 2 /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
) else (
Echo Wrong! & goto nashalo
)

goto nashalo
pause >nule >nul

Is there a reason why you want to disable the security?

Such software consumes much of the system resources and CPU resources (some up to 30% or more). There is no need to use such software if you do not often access some junk sites. Not using such security software is much more practical and convenient than overclocking the CPU.

user655362020 said:

What I have tried :

Tamper protection was disabled when I tried below mentioned things :

1. Suspend MsMpEng.exe from Resource Monitor and enable Turn off Microsoft Defender Antivirus Group policy. The policy reverts itself after reboot.
2. Use WinAero Tweaker.
3. Defender Control

The Antimalware Service Executable is still running.

Click to expand...

This works on Windows 10, and probably works on Windows 11 too.
The benefit to using Autoruns, is that things are easy to do and undo.

Anyway... if you uncheck the boxes shown, you will be able to stop the Microsoft Defender and the Windows Defender Services.
Stopping the Services is what stops Defender.


You need to set the Autoruns Options as shown in the lower right.
The choose: the Everything tab, and then type windows defender in the search box.








Autoruns for Windows - Windows Sysinternals






This worked like a charm on Windows 10.
It does break Windows Updates, but... you can turn Defender back on, any time you want to check for updates.
This didn't permanently break anything on Windows 10.

Ofc, you should make a full OS image backup before "trying" anything.

TairikuOkami said:

AV is pretty much a requirement in 11, just like TPM. If you disable 3rd part AV temporarily, Defender kicks in (when not disabled).

Click to expand...

I disabled it through Group Policy Editor.

JMedlock83 said:

I disabled it through Group Policy Editor.

Click to expand...

I read elsewhere that doesn't work. Microsoft did a lot of changes recently with Windows 11. Previously, this third party utility was used (successfully) but it's now broken.

Hello,

You would need to turn off Tamper Protection first, then you will be able to disable or turn off Microsoft Defender Antivirus if wanted.

Hi,
I use this in cmd as admin

Sammy888 said:

I read elsewhere that doesn't work. Microsoft did a lot of changes recently with Windows 11. Previously, this third party utility was used (successfully) but it's now broken.

Click to expand...

Works for me, and still does.

ThrashZone said:

Hi,
I use this in cmd as admin

Code:

rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f

Click to expand...

Is there a bat file for this and a reversal too?

JMedlock83 said:

Works for me, and still does.

Click to expand...

Could it be because your're using Windows 11 Pro and not Home?

I noticed that many existing features (mods) continue to work after upgrading from W10 to W11 but won't necessarily work with a clean installation of W11?

Brink said:

Hello, :)

You would need to turn off Tamper Protection first, then you will be able to disable or turn off Microsoft Defender Antivirus if wanted.

Turn On or Off Tamper Protection for Microsoft Defender Antivirus in Windows 11 Tutorial

This tutorial will show you how to turn on or off Tamper Protection for Microsoft Defender Antivirus settings in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. Tamper...

www.elevenforum.com

Enable or Disable Microsoft Defender Antivirus in Windows 11 Tutorial

This tutorial will show you how to enable or disable Microsoft Defender Antivirus in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. You must be signed in as an...

www.elevenforum.com

Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11 Tutorial

This tutorial will show you how to enable or disable real-time protection for Microsoft Defender Antivirus in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. Real-time...

www.elevenforum.com

Click to expand...

Hi Brink, so can you confirm the tutorial is still valid?

And that the instructions in fact disable MsMpEng.exe?

Sordum Defender Control is still working for me.

Stigg said:

Sordum Defender Control is still working for me.

Defender Control v2.1

In Windows there is no option to completely turn off Microsoft Defender , Defender control is a Portable freeware to disable Ms Defender.

www.sordum.org

Click to expand...

Ok, Now I'm very concerned. The comments on the site specifically say Sordum is broken. I can confirm that's the case too.

Sammy888 said:

Ok, Now I'm very concerned. The comments on the site specifically say Sordum is broken. I can confirm that's the case too.

Click to expand...

Where do any current comments say that it's broken?
I have even put my glasses on and can't see any. I am assuming you're using Windows 11.
Did you add it to the Exclusion List from the menu? There are plenty of dummies that post on that site.

It is working fine for me.
It's a standalone program. Nothing to install.

Installing AV (Adaware), disabling Defender, uninstalling AV, it still works with the latest version 4.18.2201.10.

Sammy888 said:

Hi Brink, so can you confirm the tutorial is still valid?

And that the instructions in fact disable MsMpEng.exe?

Click to expand...

It disabled Microsoft Defender Antivirus in the Windows Security app at the time the tutorial was created.

Sammy888 said:

Is there a bat file for this and a reversal too?

Click to expand...

Hi,
Nope

MS updates do a good job of undoing stuff related to disabling defender lol