6 ms·

Defender is a real irritant when doing security research and is near impossible to turn off completely and permanently. Even using the Group Policy Editor or re

Defender is a real irritant when doing security research and is near impossible to turn off completely and permanently. Even using the Group Policy Editor or regedits is not reliable. If you do get it to stop, it will randomly reenable itself weeks later (perhaps some timer, perhaps due to some update if you forgot to turn those off). For the vast majority of people this is a good thing!

vezycash 2y ago
Easiest way to disable defender was to install another anti virus. Did this change?
- malfist 2y ago
  If they want to do research they probably prefer no AV. That said there are some no-op AV's that are specifically for tricking defender to shut off and not actually do anything
  - GordonS 2y ago
    I was just wondering if a no-op AV might work! But I thought perhaps not, as I thought Microsoft insisted on AVs running as PP/PPL (Protected Process / Protected Process Light), which isn't realistic for OSS. Are you able to point to one please? Would love to try it and see if it works!
    - PKop 2y ago
      Isn't this what this post is about?
      - GordonS 2y ago
        Ach, I think you're right, that looks to be what they're doing.
- jiggawatts 2y ago
  Yes. Current versions of Defender won’t disable scanning even if another anti virus is installed. At most, it will stop reporting infections. The CPU overhead however cannot be avoided by normal means. Microsoft Dev Drive exists purely as a workaround to this self-imposed problem.
gruez 2y ago
>it will randomly reenable itself weeks later (perhaps some timer, perhaps due to some update if you forgot to turn those off). Probably caused by feature updates. I have it disabled on LTSC and it hasn't reenabled itself in years.
tossit444 2y ago
ToggleDefender (https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefender.bat https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefende...) still works to this day!
- bozey07 2y ago
  No offense to the author, but was this deliberately written to hard to read? Or does all PS look like this?
dataflow 2y ago
I've never seen Defender re-enable itself, provided that tamper detection is turned off in addition to the other stuff (in group policy and whatnot). Have you made sure to do that? And are you on 10 or 11?
- unaindz 2y ago
  Not op but yes, without tamper protection and disabled via group policy it reenables itself anyways. Seen it in both 10 and 11.
  - dataflow 2y ago
    Weird. I wonder why I don't see this on my Windows 10 machine. It's possible I've done something else that prevents it from running that I'm now forgetting, I don't recall. But I do see that I have something like 6 group policy settings modified, it's not just one or two. Have you tried disabling the service & driver (WinDefend)?
- vitorgrs 2y ago
  If you are in insider builds, it happens weekly once a new update arrives.
deleted 2y ago
[deleted]

vezycash 2y ago

Easiest way to disable defender was to install another anti virus. Did this change?

malfist 2y ago
If they want to do research they probably prefer no AV. That said there are some no-op AV's that are specifically for tricking defender to shut off and not actually do anything
- GordonS 2y ago
  I was just wondering if a no-op AV might work! But I thought perhaps not, as I thought Microsoft insisted on AVs running as PP/PPL (Protected Process / Protected Process Light), which isn't realistic for OSS. Are you able to point to one please? Would love to try it and see if it works!
  - PKop 2y ago
    Isn't this what this post is about?
    - GordonS 2y ago
      Ach, I think you're right, that looks to be what they're doing.
jiggawatts 2y ago
Yes. Current versions of Defender won’t disable scanning even if another anti virus is installed. At most, it will stop reporting infections. The CPU overhead however cannot be avoided by normal means. Microsoft Dev Drive exists purely as a workaround to this self-imposed problem.

gruez 2y ago

>it will randomly reenable itself weeks later (perhaps some timer, perhaps due to some update if you forgot to turn those off). Probably caused by feature updates. I have it disabled on LTSC and it hasn't reenabled itself in years.

tossit444 2y ago

ToggleDefender (https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefender.bat https://github.com/AveYo/LeanAndMean/blob/main/ToggleDefende...) still works to this day!

bozey07 2y ago
No offense to the author, but was this deliberately written to hard to read? Or does all PS look like this?

dataflow 2y ago

I've never seen Defender re-enable itself, provided that tamper detection is turned off in addition to the other stuff (in group policy and whatnot). Have you made sure to do that? And are you on 10 or 11?

unaindz 2y ago
Not op but yes, without tamper protection and disabled via group policy it reenables itself anyways. Seen it in both 10 and 11.
- dataflow 2y ago
  Weird. I wonder why I don't see this on my Windows 10 machine. It's possible I've done something else that prevents it from running that I'm now forgetting, I don't recall. But I do see that I have something like 6 group policy settings modified, it's not just one or two. Have you tried disabling the service & driver (WinDefend)?
vitorgrs 2y ago
If you are in insider builds, it happens weekly once a new update arrives.

deleted 2y ago

[deleted]