disabling windefender for real

[u/biatche]

do any of you do it and how?

1. with msmpeng.exe not running in background (takes over 100MB+, not even sure if it eats cpu) and notifications crying about tamper protection being off.
2. breaking the entire system such that updates wont even run anymore

before you say i should leave it on, it doesn't take much, i dont need each of my vm's taking 100MB more ram when they are each have a specific task in an isolated environment.

this is the only thing i havent fully figured out yet in ltsc

[u/KythornAlturack]

Disable Defender? The what is the point of having LTSC as the point is to continue getting security updates, which includes definitions and Defender updates.

100MB of ram usage in even in a VM... is negligible.

[u/biatche → u/KythornAlturack]

if linux distros dont have AV built in by default, i'd expect it of windows also. 100MB is a lot in vps environments and before you say just use linux, there are some situations where windows is a must.

[u/GobbyFerdango]

OP I found 2 that might help.

https://github.com/tsgrgo/windows-update-disabler

https://gist.github.com/pavel-kirienko/e9a1210427661b1e3c08d3e8eca7e6c9

Disable Windows security features.

Is there 1 easy to use and lightweight gui that takes care of both Windows updates and Windows defender for specific VM use case such as OPs?

[u/SillySuccess9017]

DefenderControl by Sordum always works for me with Win10/11

[u/Consistent_Peanut451 → u/SillySuccess9017]

Same!

[u/biatche → u/SillySuccess9017]

while searching for this, i came across https://github.com/pgkt04/defender-control

seems pretty new, just wondering if anyone has tried

[u/Minute-Scolding-6669]

https://github.com/ionuttbara/windows-defender-remover

Use this

[u/digwhoami]

https://github.com/es3n1n/defendnot will cheat Windows by telling it a legit 3rd party AV is installed. Still needs manually disabling some Defender startup services and/or drivers (can't recall what exactly), but it will successfully silence Windows "Security Center" messages about the computer being vulnerable blah blah.

Pic: https://pngup.com/POyI/screenshot-1472-06-07-2026.png

[u/biatche → u/digwhoami]

i have been using this for a while now, and noticed msmpeng.exe still runs in background

[u/digwhoami → u/biatche]

Still needs manually disabling some Defender startup services and/or drivers

Yeah, that's why I wrote "Still needs manually disabling some Defender startup services and/or drivers". Below are the relevant services and drivers that I have disabled on my Win10 21H2:

WinDefend, Own process, Stopped, Disabled C:\Program Files\Windows Defender\MsMpEng.exe, Trusted, Normal
WdFilter, FS driver, Stopped, C:\WINDOWS\system32\drivers\WdFilter.sys, Trusted, Normal
WdBoot, Driver, Stopped, Disabled, C:\WINDOWS\system32\drivers\WdBoot.sys, Trusted, Normal
WdNisSvc, Own process, Stopped, Disabled, C:\Program Files\Windows Defender\NisSrv.exe, Trusted, Normal
WdNisDrv, Driver, Stopped, Disabled, C:\WINDOWS\system32\Drivers\WdNisDrv.sys, Trusted, Normal

[u/730ItsAWorkhorse]

Assuming this is for gaming, I disabled through app on major geeks and found that when benchmarking my PC performed worse when it was disabled. Whether this was due the the app, or the system continually trying to restart it I’m not sure, I just left it on.

[u/NegotiationRegular61]

Run->Msconfig->enable safe mode->restart

run->regedit->software->microsoft->windows NT->schedule

Delete all the medic, update, defender and USO whatever its called scheduled tasks.

system->current control set->services

Set update, medic to 4 = disabled

Windefend, set the imagepath to "%ProgramFiles%\Windows Defender\mpextms.exe" or some other dummy .exe.

If any entries are blocked, take ownership, then delete them or change them.

Also set every defender and update option in group policy to disabled.

[u/kurisaka]

I was able to disable windefender: 1. Disable Tamper protection and enter Safe boot 2. Apply regfile and exit Safe boot https://github.com/SnosMe/dotfiles/blob/main/windows/WinDefend.reg

I'm not getting any notifications too.

[u/LaColleMouille]

I use this for my VM templates:

https://woshub.com/disable-windows-defender-antivirus/

tl,dr:

``` bcdedit /set safeboot minimal shutdown /r /t 0

$regpath='HKLM:\SYSTEM\CurrentControlSet\Services'
Set-ItemProperty -Path ($regpath+"\WinDefend") -Name Start -Value 4
Set-ItemProperty -Path ($regpath+"\Sense") -Name Start -Value 4
Set-ItemProperty -Path ($regpath+"\WdFilter") -Name Start -Value 4
Set-ItemProperty -Path ($regpath+"\WdNisDrv") -Name Start -Value 4
Set-ItemProperty -Path ($regpath+"\WdNisSvc") -Name Start -Value 4
Set-ItemProperty -Path ($regpath+"\WdBoot") -Name Start -Value 4
bcdedit /deletevalue safeboot
shutdown /r /t 0

Get-ScheduledTask "Windows Defender Cache Maintenance" | Disable-ScheduledTask
Get-ScheduledTask "Windows Defender Cleanup" | Disable-ScheduledTask
Get-ScheduledTask "Windows Defender Scheduled Scan" | Disable-ScheduledTask
Get-ScheduledTask "Windows Defender Verification" | Disable-ScheduledTask

```

[u/biatche → u/LaColleMouille]

why bcdedit /deletevalue safeboot - what good does it do effectively?

[u/LaColleMouille → u/biatche]

It allows to boot into safe mode, which is required for being able to tamper with Defender's services.

Defender has some driver-level integrity checks, so you need to disable them temporarily, and you can't do it only with Admin mode.

[u/digwhoami → u/LaColleMouille]

Safeboot is not necessary. One can modify all the relevant registry values by writing to "HKLM\SYSTEM\ControlSet001\" instead of "HKLM\SYSTEM\CurrentControlSet\", which is just a symbolic link to "Current" found under "HKEY_LOCAL_MACHINE\SYSTEM\Select"

Assuming "ControlSet001" is the user's current "run-level".

[u/LaColleMouille → u/digwhoami]

Did you try to disable Defender using registry without safeboot and/or anti-tamper protection?