[ARCHIVED] Windows Editions Reconstruction Project

CMGE Windows Defender Disablement

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableRealtimeMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet]
"SpynetReporting"=-
"SubmitSamplesConsent"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates]
"FallbackOrder"=-
"DefinitionUpdateFileSharesSources"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontReportInfectionInformation"=dword:00000001
"DontOfferThroughWUAU"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"SettingsPageVisibility"="Hide:windowsdefender"

There is also Windows Defender Scheduled Tasks?

 

Q: What is Microsoft thinking of?

Fact for Server:
Allow Windows-Defender feature to be disabled on one hand, yet, keep pushing Malware Removal Tool updates on the other hand.

And, Antimalware-Scan-Interface, SenseClient. So complicated.

 

Perhaps the most critical step for me to disable Defender is to delete the WinDefend service. I speculate that the WinDefend service is gone, and all other functions that depend on this service will fail.

It seems that the WinDefend service will be turned on again after being disabled for a period of time, if it is not deleted.

 

Windows Defender Scheduled Tasks.

e.g. 19041

Code:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Defender]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8E406494-FE1A-47D5-801E-E6ED35AA7258}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EBCB6D08-90F4-42F5-BB58-8998535C3609}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0E276D0-C820-4896-AA2F-816132FCDDED}]

 

Yes I found these Scheduled Tasks
Windows Defender Cache Maintenance
Windows Defender Cleanup
Windows Defender Scheduled Scan
Windows Defender Verification
They are all activated using MpCmdRun.exe.

Spoiler: Windows Defender Verification

Microsoft Windows [版本 10.0.21364.1]
(c) Microsoft Corporation。保留所有权利。

C:\WINDOWS\system32>cd C:\Program Files\Windows Defender

C:\Program Files\Windows Defender>MpCmdRun.exe -IdleTask -TaskName WdVerification
Start: Idle Task - WdVerification
ERROR: Creating Idle Notifier Context Failed 0x800106ba
CmdTool: Failed with hr = 0x800106ba. Check C:\Users\ADMINI~1\AppData\Local\Temp\MpCmdRun.log for more information

C:\Program Files\Windows Defender>

Spoiler: MpCmdRun.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

M p C m d R u n : C o m m a n d L i n e : " C : \ P r o g r a m F i l e s \ W i n d o w s D e f e n d e r \ M p C m d R u n . e x e "

S t a r t T i m e : hT擭 4 g 2 3 2 0 2 1 0 9 : 1 3 : 3 4



M p E n s u r e P r o c e s s M i t i g a t i o n P o l i c y : h r = 0 x 1

M p C m d R u n : E n d T i m e : hT擭 4 g 2 3 2 0 2 1 0 9 : 1 3 : 3 4

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -





- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

M p C m d R u n : C o m m a n d L i n e : M p C m d R u n . e x e - I d l e T a s k - T a s k N a m e W d V e r i f i c a t i o n

S t a r t T i m e : hT擭 4 g 2 3 2 0 2 1 0 9 : 1 4 : 5 2



M p E n s u r e P r o c e s s M i t i g a t i o n P o l i c y : h r = 0 x 1

S t a r t : I d l e T a s k - W d V e r i f i c a t i o n

T i m e I n f o - hT擭 4 g 2 3 2 0 2 1 0 9 : 1 5 : 0 2 E R R O R : C r e a t i n g I d l e N o t i f i e r C o n t e x t F a i l e d 0 x 8 0 0 1 0 6 b a

M p C m d R u n . e x e : h r = 0 x 8 0 0 1 0 6 b a .

M p C m d R u n : E n d T i m e : hT擭 4 g 2 3 2 0 2 1 0 9 : 1 5 : 0 2

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Because there is no WinDefend service, these scheduled tasks are useless.

Now I will delete these scheduled tasks for more system resources. Thank you.

 

Yes, and it would be nice to hide it from settings.

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"SettingsPageVisibility"="Hide:windowsdefender;"

 

reconstruction has done a lot of work for me

 

Good for you.

Q: How to take good care of manifest?

No chance this life I think.

But, 7Customizer does tamper it:

Code:

      <File method="deleteLine" path="Windows\winsxs\Manifests\*winemb-shell-access..oyment-languagepack_*.manifest" string="Microsoft-Windows-calc.Resources" xmlParents="dependency"/>

No, this is Chopping.

 

Perhaps if you do not modify the manifest, Windows cannot determine whether certain functions have been removed or even cause system failure.

 

Yes, perhaps good for older builds. But I am thinking of this for builds from 18362 forward.

Not a chance because of PSFX update format.

Forget it.

 

Wishing Server 2022 in ServerWeb style can be the second best.

 

Dear friend @xinso,

What you said does not make any sense to me, I would never fail to do something that is not wrong, such as sharing my knowledge to help others, just because someone envious and incapacitated made worthless criticisms about it.

By any chance, if any stupid person who enters the forum and out of envy says that this project of yours sucks, would you stop continuing it?

I want to believe that you are smarter than that ... so I am still waiting for your answer to my quoted question and the other of our colleagues who need your help, I am able to bet that whoever criticized you, follows all your instructions and makes several mistakes like any of us, but doesn’t have the humility to say that and lose help, because he thinks he is superior, and for me, anyone who thinks this way is superior to what remains on the grass after the cow makes his own physiological needs ...

Thank you for sharing your accurate knowledge and I'm sorry if something I said, but for me and for many here, your knowledge is valuable.

Best Regards.
@JeepWillys58

 

Reserved.

 

Q: Where are Server's SenseClient and Malware Removal Tool?

 

Reserved.

 

Does WinDefend stop SenseClinet too?

(Do "SenseClient", "AntiMalware Scan Interface", and "Malware Removal Tool" belong to "Windows Defender"?)

 

Reserved.

 

Look back and see if I was wrong.

 

SenseClient of 20339.2 Server 2022

amd64_windows-senseclient-service_31bf3856ad364e35_10.0.20339.2_none_319f8cad58325c7c.manifest
amd64_windows-senseclient-service.resources_31bf3856ad364e35_10.0.20339.2_xx-xx_a2011650c92cdb45.manifest

The fact is: CMGE not only disable Windows Defender, but also disable Windows Defender SmartScreen.

 

Reserved.