The Difficulty to Remove Windows Defender and the Potentional Risks

There is also relatively new Microsoft Defender Core Service

Disabling Defender services like WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv, and MDCoreSvc is NOT a reliable or clean way to prevent Defender from scanning anything, especially temporarily. These services are tightly integrated with Windows security infrastructure and protected by Tamper Protection, service hardening, and kernel-mode drivers.

​

Why disabling them is problematic​

Tamper Protection blocks service manipulation, even from SYSTEM-level processes unless you unload WdFilter.sys and modify registry keys in Safe Mode.
Disabling services via registry (Start=4) or permissions hacks can break Defender in unpredictable ways, potentially causing:

• Update failures
• Broken Windows Security UI
• Inability to re-enable Defender cleanly

Re-enabling them requires rebooting and restoring multiple registry keys, which is messy and error-prone.

What actually happens when you install ESET (or any third-party AV)​

Microsoft Defender Antivirus (WinDefend) enters passive mode, not disabled.
Core services like WdFilter and WdBoot may remain loaded, especially for compatibility and fallback.
Tamper Protection remains active unless manually disabled.
Windows Security Center still monitors Defender status, and Defender can reassert itself if ESET is uninstalled or fails.

Why "Just disable services" is a dangerous mentality​

Disabling services manually is like pulling fuses out of your car because you don't like the dashboard lights. Sure, it might stop the blinking, but now your airbags won't deploy.

Here's what people forget:
Windows services are interdependent.
Disabling one can cause cascading failures in:

• Updates
• Security features
• Device drivers
• Event logging
• Network stack

And worst of all: Windows doesn't always fail gracefully. It might seem fine until one day, you'll learn it the hard way the fact that Defender is so deeply interwoven with the whole Windows OS that microscopic fps improvements that can be measured in the 0.1% lows of some games titles with "optimizations" are for those who will insist on the benefits of carrying water to the sea. So much so, we even have a name for it. It's called "optimization theater", and I have seen lots of it. The popcorn industry loves it to bits. Literally.

oldschool said:

Why? If real time scanning is off, you are without protection. Windows Defender has a very good reputation with gamers. Your machine has good specs.

OTOH, if you really despise it for some reason, install Panda Free AV. It's like having no AV at all : very light resource consumption, and the worst protection possible.

Click to expand...

I have Kaspersky Plus I am not without any protection, it's shown under "My Computers" at the bottom of this post.
I prioritize advanced security features and comprehensive protection, Windows Defender may not offer the same level of advanced threat detection and specialized features as Kaspersky Plus.

PvtJohnTowle said:

I have Kaspersky Plus I am not without any protection, it's shown under "My Computers" at the bottom of this post.

Click to expand...

Are you sure about where you place your trust?
Kaspersky is headquartered in Moscow, Russia.
Kaspersky was previously a programmer for the Russian Military.

TraderGary said:

Are you sure about where you place your trust?
Kaspersky is headquartered in Moscow, Russia.
Kaspersky was previously a programmer for the Russian Military.

Click to expand...

N-o-o-o-o-o-o-o-o. Not again!!!

TraderGary said:

Are you sure about where you place your trust?
Kaspersky is headquartered in Moscow, Russia.
Kaspersky was previously a programmer for the Russian Militar

Click to expand...

Thanks for the heads-up, Gary. I’m aware of the geopolitical concerns around Kaspersky, and I’ve weighed the risks before using it. While no software is 100% ‘trust neutral,’ I’ve found Kaspersky’s detection rates and features (like its VPN and payment protection) work well for my needs. I also take extra precautions—firewall rules, network monitoring, and regular audits—to mitigate any hypothetical supply-chain risks.

That said, I totally get why some users (or orgs) might avoid it. If you’ve got alternative recommendations (e.g., Bitdefender, ESET, or even hardened setups like CrowdStrike for advanced users), I’m all ears! Always good to compare notes on security tools.

@PvtJohnTowle
I wanted to be sure you were aware that Kaspersky was located in Moscow, Russia and that Kaspersky himself was previously a programmer for the Russian Military. This raises the question of what controls could the Russian government exert over Kaspersky. Personally, I could never, ethically or morally, put any of my money into the Russian economy.

@PvtJohnTowle Hi John, try excluding everything in Windows defender settings (Go to Exclusions). That would be C Drive or be specific and only exclude folders and files that are needed for what you do with the computer. That should work.

I said it should work for you because Exclusions are working for me. In my case, I don't play games or use another AV. I just don't use AV. Before W11, in W10, Brink's tutorial for turning off WD worked but now you can't totally disable Defender's AV using his tutorial. I found some solutions in the internet that might work but I am not going to use them.

I got this new computer last week, at first I was going to try to let things be with Defender but after 3 or 4 days of using the computer, I began feeling lags when using Firefox. And that I was not going to accept. So, I excluded Firefox folder in Program files, and the ones in AppData (this two are probably not needed but I did it anyway). I also excluded the Sandboxie folder as everything I run in the computer, runs sandboxed (with rare exceptions). And last, I excluded MP4 and JPG and PNG. And that has done it.

Using Firefox now is back to how I am used to, pages opening immediately. Opening folders with a lot of videos or pictures also load quick and nice. No lags or interference from Defender, just like if it wasn't there even though it is still here.

Bo