Using RegEdit to disable Windows Defender in Windows 11

Using RegEdit to disable Windows Defender in Windows 11
An alternative way to disable Windows Defender in Windows 10 or 11 is to use the registry. For this, you will also need to boot into safe mode. Follow step 1 from the previous chapter to boot into safe mode.

Once booted in Safe Mode: (Win key + R,,select Boot tab and then select safe boot)

1. Press Windows key + R
2. Type regedit <enter> to open the registry
3. Use the "Find" feature and locate each folder below and click to change "start" from "3" to "4"
   • Sense
   • WdBoot
   • WdFilter
   • WdNisDrv
   • WdNisSvc
   • WinDefend
4. Exit out of Safe Mode

Revert the change
If you no longer want to disable Windows Defender you can easily revert the change. You will need to restart into safe mode again and give System and Trusted Installer full access permission on the Platform folder.

When you used the registry method, then restore the values to:

HKLM\SYSTEM\CurrentControlSet\Services\Sense\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\Start 0
HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\Start 0
HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\Start 2

Why all this hassle??


1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click

2) Download and run the Disable Defender.reg and all the services would be disabled

I just let my AV program disable it automatically

The-Hive said:

I just let my AV program disable it automatically

Click to expand...

That's all fine but the service would always be running and it does affect CPU usage.

My question is, why would you want to disable Windows Defender?

The-Hive said:

I just let my AV program disable it automatically

Click to expand...

This. As per Task Manager and Resource Monitor I don't see Windows Defender using any CPU usage.

Spartan said:

That's all fine but the service would always be running and it does affect CPU usage.

Click to expand...

If it uses that much to cause you a problem there is something wrong, not necessarily defender causing it. Mine uses none I'm with @MadScientist on that one. One thing I have noticed many times in the past is programs being blamed for peoples computers, for example wrongly set up or not the best options selected for example it may well be something else on a system causing the AV to work harder than needed hence, using more resources. Not saying that is the problem here but it's worth looking into why it is using more resources than you expect it to

Sordum software also do a freebee called Defender Control along with other useful windows tweakers.

Spartan said:

AV-Comparatives: Microsoft Defender has a large impact on system performance - gHacks Tech News

Click to expand...

When they say
"large"
they mean
"larger than other security products"


All the best,
Denis

IF I change... What do I go to? Panda? How's the detection of other AVs?

probe7 said:

IF I change... What do I go to? Panda? How's the detection of other AVs?

Click to expand...

Panda is my favorite AV even though I have a paid license for ESET NOD32 Antivirus. The reason I like it more, is just like ESET, it has no bloatware, no browser extensions, no driver updatersd or yada yada, just a powerful scanner that is light as heck. Just make sure when installing it to uncheck the button which says install Opera browser and in the settings, scroll down to the end in the general tab and disable the two checkboxes for Panda news.

See the latest AV-comparatives performance test = Comparison

probe7 said:

IF I change... What do I go to? Panda? How's the detection of other AVs?

Click to expand...

Search the web, there are many comparison and rating sites to give you a good picture of what will suit you the best

I would go with Panda, if I find any heavy load from Defender in the future. Like Spartan says, Panda is supposed to be the lightest, a pretty good AV and I hate bloatware.

Oops... now I read this over at PCmag website about Panda... (I don't know what to do)

I wouldn't trust those AV comparison sites; they're usually just paid to promote a certain product. You can find several AV "tests" which all contradict each other.

These services should be able to be disabled and their start type changed from the services manager?

x BlueRobot said:

I wouldn't trust those AV comparison sites; they're usually just paid to promote a certain product. You can find several AV "tests" which all contradict each other.

These services should be able to be disabled and their start type changed from the services manager?

Click to expand...

Windows will not allow your to disable Defender, the second you pause your current antivirus, windows see's this as a time for vulnerability and has Defender stepping in to the task..This way I have posted is the most effective means to disable it via the Registry

sourcecode said:

Also, do you happen to have other advice on configuring/disabling in Windows? I mead another post asking for help on thorough configuration since I still am not really familiar with the current version - W11.

Click to expand...

what do you mean?

win aero tweaker does this with a tick, and dozens more tweaks besides. Q: Why does anyone want to disable defender. I leave it alone and my security software does not complain. In the best AV software, Defender does not even figure??

Copy of Review:

Microsoft’s history of providing antivirus protection goes all the way back to DOS, but it’s never seemed to harm the third-party antivirus industry. In Windows 10, Microsoft Defender Antivirus not only protects against all types of malware, but it also manages numerous other security features. Microsoft Defender turns on to protect systems that have no other antivirus. As soon as you install a third-party solution, it goes into suspended animation to avoid conflict. By making sure that every Windows installation has protection against malware, Microsoft helps contribute to a kind of herd immunity. Defender does a decent job, too, but the best competitors, including free ones, do even better.

@AlanJr

Why bother with all this stuff

Just turn off the actions by bringing up the security dashboard.

I can't currently think of ANY domestic (i,e Home computer) security package that is anywhere as near as good as WD on latest versions of W11 (and WD gets updated often several times a week) unless one wants to bypass security in installing stuff designed to prevent activation / bypass activation of products by things like "Fake KMS servers" or downloading (aka "torrenting") copyrighted material from -- well we all know where those sites are.

You can create a script that runs at startup to disable it if you have to but why would you want to.

Cheers
jimbo

Hey Everyone,

I'm new to the forum here so don't beat me up too bad for my two cent.

In my experience (and you can test this yourself) Windows Defender Firewall actually slows down the overall performance of Windows 7, 8, 10, and 11 in a noticeable way. While it may seem counter-intuitive to install a 3rd party AV and FW based on the general effectiveness of Windows Defender, the performance issues it creates and the offline detection vulnerabilities it has make reputable 3rd party apps worth the swap where performance gain is a concern.

However, with Windows 11 does come an issue with disabling Windows Defender Firewall. Even after installing a 3rd party FW like Comodo or any other, and despite the service provider list showing your preferred FW as active, it also shows in the provider list that Windows FW is also on. I even had a few Windows FW prompts pop up asking me to allow other programs including my 3rd party FW.

If you go into Windows Security and choose FW & Network Protection and then click each of Domain, Private, and Public, it will show you that no action is needed and that your 3rd party app is actively handling the duties while at the same time telling you that Windows Defender FW is not active. So, there is clearly a discrepancy in the information Win 11 is providing concerning the active/inactive status of Windows Defender FW.

As such, it seems that the methods outlined for disabling Windows Defender FW services by registry tweaking or other means appears valid and exactly what I have been looking for to combat this weird dual status of active/inactive. Everything else in Win 11 seems to work perfectly fine for me.

One other thing I will add is that disabling the services for Windows Search and for SysMain (Win 10, 11) will also make a noticeable impact on how quickly your system will load its startup items after a boot or reboot and allow the CPU to quickly get to an idle state. Of course, if you're still using WMP for anything you may want to hold off on disabling Windows Search service.

I've attached some screen shots of my system and the FW issue I'm experiencing. I hope this helps someone else down the road.