Rootctl

Disable Defender and Real Time Protection

Powershell / CMD / Regedit / GPO

Disable Microsoft Defender and Real Time Protection






---

Permanently Disable Microsoft Defender in Windows 11 and Real Time Protection ?
#################################################################################

Disable Tamper Protection First
------------------------------------------------
1-Press Win + S and type Windows Security. Click on the Open option to launch the app.
2-Click on the Virus and threat protection option on the home page.
3-Find the Virus and threat protection settings section and click on the Manage settings option.
4-Scroll down and click on the Tamper Protection toggle to disable it.
5-Disable Tamper Protection option
6-Close the Windows Security app.



1. Disable Microsoft Defender Using Group Policy Editor
------------------------------------------------------------------------------------
1-Press Win + R to launch the Run command box. Type gpedit.msc in the text input area and press the Enter key.
2-Group Policy Editor will launch. Click on the Computer Configuration option on the home page.
3-Navigate to Administrative Templates > Windows Components > Windows Defender Antivirus > Real-time protection
4-Locate and click on the Microsoft Defender Antivirus option. Double-click on the Turn-off Microsoft Defender Antivirus policy to edit its settings.
5-Disable Windows Defender Using Group Policy Editor
6-Select the Enabled radio button and click on the Apply button.
7-Lastly, click on the OK button and close the Group Policy Editor. Restart your system and open Windows Security.



2. Disable Microsoft Defender Using Registry Editor
--------------------------------------------------------------------------------
1-Press Win + S to open Windows Search and type Regedit. Click on the Run as administrator button.
2-In the Registry Editor windows, go to the address bar and paste the following path:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender
3-Right-click and select New > DWORD (32-bit) Value.
4-Click on the newly created DWORD (32-bit) Value and name it DisableAntiSpyware.
5-Double-click on the DisableAntiSpyware value and set the Value Data to 1. Keep the Base as Hexadecimal.


Disable Microsoft Defender Using CMD
------------------------------------------------------------
Press Win + R to launch the Run command box. Type cmd in the text input area and press Ctrl + Shift + Enter key to launch Command Prompt with admin privileges.
Now, type the following command and press the enter key:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Disabling Windows Defender for Windows Server OS :
----------------------------------------------------------------------------------


Disabling Windows Defender Manually

In the Remove Roles and Features Wizard, reach the Features step and deselect the Windows Defenders Features option
If you have PowerShell, run the following command:
-------------------------------------------------------------------------------

Uninstall-WindowsFeature -Name Windows-Defender
----------------------------------------------------------------------------------






Turn on the GUI using PowerShell 1. On your Windows Server, open Windows PowerShell as an administrator.
-------------------------------------------------------------------------------------------------------
Run the following PowerShell cmdlet: Install-WindowsFeature -Name Windows-Defender-GUI


Verify that Microsoft Defender Antivirus is running
---------------------------------------------------
Get-Service -Name windefend


Verify that firewall protection is turned on
-------------------------------------------
Get-Service -Name mpssvc




Command Prompt to verify that Microsoft Defender Antivirus is running.
---------------------
sc query Windefend



view all the services that aren't running,
------------------------------------------
sc query state= all

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server?view=o365-worldwide
.