Using RegEdit to disable Windows Defender in Windows 11

From what I've found, there is a few Windows Firewall services which are required for Windows to actually detect and install updates.

Thnk you Gemini, great post mate

Hey Folks. I just wanted to post an update on the results of my endeavor to fully eliminate Windows Defender FW in Win 11.

So, I tried the Toggle Defender batch file mentioned on page one by Spartan and it seemed to resolve the active/inactive conflict that I was experiencing in Windows Security under Providers as Windows FW now shows off instead of on. However, it did not disable the Windows Defender FW protected service in services, which is always running. I also applied the registry tweaks outlined by the OP, Alan Jr as running the Toggle Defender batch file did not set any of those registry keys to 4 for off/disabed, but they did not disable the protected service in services either after a reboot.

I managed to come across a piece of info that did work though and all it involved was going to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpssvc
and setting the DWORD start to 4 and then rebooting. Safe mode not required.

After the reboot, which went fine, the Windows Defender FW protected service now shows disabled and my PC was able to reach a CPU idle state even faster than before after the restart.

For anyone looking to use a 3rd party FW/AV program instead of Windows Defender AV/FW, I would recommend performing all three of Toggle Defender batch file, editing the OP recommended reg keys by setting the start to 4 and editing the mpssvc reg key start to 4. This appears to be the most effective and complete means of rendering Windows Defender FW moot in Win 11.

Additionally, I would like to mention that Windows Update seems to work fine, but I did decide to set the Windows Update service, wuauserv, to Auto (Delayed Start) just to be safe.

As it stands right now, with 4 browser pages open, along with task manager and services open, my CPU usage is sitting between 1 and 4 percent while my disk usage is at 0 percent and my memory usage is at 12% with all my startups including MWB Premium and Comodo FW running.

I hope others find this info useful in the future.

AlanJr said:

Using RegEdit to disable Windows Defender in Windows 11
An alternative way to disable Windows Defender in Windows 10 or 11 is to use the registry. For this, you will also need to boot into safe mode. Follow step 1 from the previous chapter to boot into safe mode.

Once booted in Safe Mode: (Win key + R,,select Boot tab and then select safe boot)

1. Press Windows key + R
2. Type regedit <enter> to open the registry
3. Use the "Find" feature and locate each folder below and click to change "start" from "3" to "4"
   • Sense
   • WdBoot
   • WdFilter
   • WdNisDrv
   • WdNisSvc
   • WinDefend
4. Exit out of Safe Mode

Revert the change
If you no longer want to disable Windows Defender you can easily revert the change. You will need to restart into safe mode again and give System and Trusted Installer full access permission on the Platform folder.

When you used the registry method, then restore the values to:

HKLM\SYSTEM\CurrentControlSet\Services\Sense\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\Start 0
HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\Start 0
HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\Start 3
HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\Start 2

Click to expand...

Why on earth would I want to disable Windows Defender? It's one of the most valuable security measures on my computers.

OldNavy said:

Sordum software also do a freebee called Defender Control along with other useful windows tweakers.

Click to expand...

though you will need to add an exception or add the defender control app onto the exclusion list first before windows defender or any other AV app (with their latest definition/detection updates) will detect and delete defender control

I removed Defender root and stem with NtLite. I have not ran an antivirus program nor had any issues with viruses/malware since the younger times of XP.

I would rather have as much of my processor/ram doing what I want it to do and not what is unnecessary. This goes for all the other windows stuff I don't need.

Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix​

Second paragraph: "AMD processors are not affected."

Spartan said:

Why all this hassle??


1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click

2) Download and run the Disable Defender.reg and all the services would be disabled

Code:

Windows Registry Editor Version 5.00

;Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000004

;Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000004

;Windows Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000004

;Windows Defender Advanced Threat Protection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense]
"Start"=dword:00000004

Click to expand...

thank youuuuuuuuuuuuu

Spartan said:

Why all this hassle??


1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click

2) Download and run the Disable Defender.reg and all the services would be disabled

Code:

Windows Registry Editor Version 5.00

;Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000004

;Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000004

;Windows Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000004

;Windows Defender Advanced Threat Protection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense]
"Start"=dword:00000004

Click to expand...

i downloaded 1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click and it did a flawless job absolutely helpful, however this 2) Download and run the Disable Defender.reg and all the services would be disabled was removed if you'd upload again to a website like 4shared.com which won't delete it, that'd be awesome

merotaha said:

i downloaded 1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click and it did a flawless job absolutely helpful, however this 2) Download and run the Disable Defender.reg and all the services would be disabled was removed if you'd upload again to a website like 4shared.com which won't delete it, that'd be awesome

Click to expand...

Spartan said:

Why all this hassle??


1) Download ToggleDefender to fully disable Windows Defender and Smart Screen in one click

2) Download and run the Disable Defender.reg and all the services would be disabled

Code:

Windows Registry Editor Version 5.00

;Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000004

;Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000004

;Windows Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000004

;Windows Defender Advanced Threat Protection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense]
"Start"=dword:00000004

Click to expand...

RD Mercer said:

My question is, why would you want to disable Windows Defender?

Click to expand...

My main reason is that as of a couple weeks ago, it was pushing my CPU temps to 60°c (Idle while not scanning)

This process no longer works writing anything to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend` even as admin you get access denied. If you try to replace the owner to Administrators or you with checknames it simply Says access denied. Tamper protection is also off when running the reg file.

the proper way to do this is to have tamper protection off and run the power shell commands on startup every time. Or to either get a replacement antivirus or a dummy antivirus that does nothing

subbastion said:

the proper way to do this is to ...get a replacement antivirus or a dummy antivirus that does nothing

Click to expand...

Panda AV Free fits the bill. You literally won't even know it's there and neither will Panda!

subbastion said:

the proper way to do this is to have tamper protection off and run the power shell commands on startup every time.

Click to expand...

Disable tamper protection, boot to safe mode, disable defender's services and it is done ("forever").

oldschool said:

Panda AV Free fits the bill. You literally won't even know it's there and neither will Panda!

Click to expand...

Sadly, installing 3rd party AV no longer disables Defender services, it just pretends.

TairikuOkami said:

Disable tamper protection, boot to safe mode, disable defender's services and it is done ("forever").
View attachment 84583 View attachment 84584

Sadly, installing 3rd party AV no longer disables Defender services, it just pretends.

Click to expand...

I want to do it programtically and not in safe mode. I want to dynamically disable realtime protection on boot based upon if it's safe to disable it. if there is a web browser or email app open it will re-enable it. I also want tamper protection to get re-enabled once the web browser is open. How does the settings UI do it? I would like to give X program permissions to do so always

TairikuOkami said:

Disable tamper protection, boot to safe mode, disable defender's services and it is done ("forever").

Click to expand...

I'm not sure if that was ever enough, but it's not working in Insider builds, at least. I assume you mean these 4 services as mentioned in the second post:

Microsoft Defender Antivirus Service
Microsoft Defender Antivirus Network Inspection Service
Windows Defender Antivirus Network Inspection System Driver
Windows Defender Advanced Threat Protection Service

While it is true that it looked right in the initial boot coming back out of safe mode, it didn't last, I believe coincident with the next boot.

RD Mercer said:

My question is, why would you want to disable Windows Defender?

Click to expand...

Because I don't use the internet, I don't install weird programs, I don't pick up thumb drives on the street, I don't remotely access my computer, I don't use free wi-fi, etc.

abactuon said:

Because I don't use the internet.

Click to expand...

So was this post sent via snail mail?

RD Mercer said:

So was this post sent via snail mail?

Click to expand...

Only verified bookmarked sites.
Or sometimes from the front page of google/bing.

abactuon said:

Only verified bookmarked sites.

Click to expand...

But they can be attacked and subverted.
So Defender would be worthwhile even for visiting trusted sites such as those.


Denis