Delete\Remove Defender from the install.wim Is it possible ?

Discussion in 'Windows 10' started by tnx, Aug 9, 2015.

  1. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    #1 tnx, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    Had a funny experience with my latest Win 10 test install.

    http://forums.mydigitallife.net/threads/63944-Fresh-install-it-deleted-some-files-for-Quite-odd

    So I would like to ask and test summet out.

    Is it possible to delete or remove Defender from the install.wim.

    I have just run this
    Code:
    DISM /Image:%~dp0mount /Get-Provisionedappxpackages > C:\DISM\Win10ProAppsList.txt
    And got a long list of APPs but Defender is not one of them.
    I sort of expected this but was rather hoping some clever person knew what to do and could point me in the right direction.

    ;)
     
  2. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    6,686
    10,145
    210
    #2 murphy78, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    Yes, you can completely remove windows defender by using install_wim_tweak and removing the various defender packages.
    I actually wouldn't recommend that, though, as some of the defender files are needed for other things.

    Instead, you can disable defender by modding a simple registry key.
    I've already made a script for that. You're welcome to use.
    Just rename this txt as Defender.cmd
    Code:
    @echo off
    
    
    title Disable/Enable Windows Defender
    color 1f
    :Begin UAC check and Auto-Elevate Permissions
    :-------------------------------------
    REM  --> Check for permissions
    >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
    
    
    REM --> If error flag set, we do not have admin.
    if '%errorlevel%' NEQ '0' (
    echo:
    echo   Requesting Administrative Privileges...
    echo   Press YES in UAC Prompt to Continue
    echo:
    
    
        goto UACPrompt
    ) else ( goto gotAdmin )
    
    
    :UACPrompt
        echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
        echo UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"
    
    
        "%temp%\getadmin.vbs"
        exit /B
    
    
    :gotAdmin
        if exist "%temp%\getadmin.vbs" ( del "%temp%\getadmin.vbs" )
        pushd "%CD%"
        CD /D "%~dp0"
    :--------------------------------------
    
    
    :Check the key:
    (reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware"|find /i "0x1")>NUL 2>NUL
    if %errorlevel% neq 0 GOTO :KEYOFF
    
    
    :KEYON
    echo ============================================================
    echo Windows Defender currently disabled.
    echo Would you like to re-enable it? (Y/N)
    echo ============================================================
    echo.
    choice /c yn /n
    If %ERRORLEVEL% NEQ 1 GOTO :QUIT
    
    
    Echo Changing Registry key
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /D 0 /T REG_DWORD /F>NUL 2>NUL
    IF %ERRORLEVEL% NEQ 0 GOTO :ERROR
    Echo.
    
    
    Echo Windows Defender enabled
    Echo.
    goto :QUIT
    
    
    
    
    :KEYOFF
    echo ============================================================
    echo Windows Defender is currently enabled.
    echo Would you like to disable it? (Y/N)
    echo ============================================================
    echo.
    choice /c yn /n
    If %ERRORLEVEL% NEQ 1 GOTO :QUIT
    
    
    Echo Changing Registry key
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /D 1 /T REG_DWORD /F>NUL 2>NUL
    IF %ERRORLEVEL% NEQ 0 GOTO :ERROR
    Echo.
    
    
    Echo Windows Defender disabled
    Echo.
    goto :QUIT
    
    
    
    
    :QUIT
    echo ============================================================
    echo Press any key to exit...
    echo ============================================================
    pause>NUL
    goto :EOF
    
    
    :ERROR
    echo ============================================================
    echo The script ran into an unexpected error setting reg key.
    echo Press any key to exit...
    echo ============================================================
    pause>NUL
    goto :EOF
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    Thanks for the info and the script.

    I will give this a whirl.


    :D
     
  4. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    Here's another question.

    Can this REG be tweaked in a mounted install.wim and saved ?
     
  5. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    6,686
    10,145
    210
    All reg keys can be if you know your way around reg load / unload

    I would advise against modding any offline services, tho. I've had BSOD failures on first boot trying to mess with those.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    I have done a little work with Win 7 & 8.1 mounted REG entries. I may give it a go.

    Just tested the script out. It's beautiful. :eek:

    Thank you very much.
     
  7. jeff69dini

    jeff69dini MDL Addicted

    Nov 22, 2008
    767
    181
    30
    #7 jeff69dini, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    yes I removed defender from install.wim , but had some strange things happen in task scheduler, it would crash, or complain about the task not running, seemed removing defender made things a bit unsetlled so I figured it was not worth it to totally remove it
     
  8. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    6,686
    10,145
    210
    I haven't tried messing with taskchd stuff, but I know the get-windowsupdates powershell command won't run without the appropriate dll from the defender directory.
    You could probably go through and replace the files you need, but if you're going to do all that, why not just leave it there and disable it, right? :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. pf100

    pf100 MDL Expert

    Oct 22, 2010
    1,177
    1,592
    60
    Because we suspect defender is deleting files either during or immediately after install. Do you know if defender runs during install or not? Because if not, and it only runs after install, then running your script as the first thing you do after install should fix the problem. I second the nice script sentiment.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. jeff69dini

    jeff69dini MDL Addicted

    Nov 22, 2008
    767
    181
    30
    so as you know in 10, there is an option under defender settings that states something like we will turn this back on after a while if it is turned off, does your script take that into account? thanks
     
  11. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    6,686
    10,145
    210
    Well, I believe it starts the various services during the first reboot portion of setup.
    Since defender runs as a service, it likely starts there.
    Whether it actually blocks stuff during oobe or setupcomplete, I really don't know.
    I've never actually tried to get it to run anything that I knew the default definitions would block.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    6,686
    10,145
    210
    That's only for the settings app thing. This reg key is for group policy disable, which won't turn itself back on.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  13. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    Some great info here.

    Thanks everybody.
     
  14. T-S

    T-S MDL Guru

    Dec 14, 2012
    3,988
    1,318
    120
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    #16 tnx, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Thought I would have a go at using DISM to remove Defender.

    using the install_wim_tweak.exe I got the package names.
    Pulled out the Defender names.

    I have a nice DISM folder structure which has served me well in Win 7 and Win 8.
    So inside of Win 100 I mount my install.wim

    then I run this command
    Code:
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-AM-Default-Definitions-Package~31bf3856ad364e35~amd64~~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Client-Package~31bf3856ad364e35~amd64~en-GB~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Client-Package~31bf3856ad364e35~amd64~~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Client-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Client-WOW64-Package~31bf3856ad364e35~amd64~~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~en-GB~10.0.10240.16384
    DISM /Image:%~dp0mount /Remove-Package /PackageName:Windows-Defender-Group-Policy-Package~31bf3856ad364e35~amd64~~10.0.10240.16384
    All I get is error say Access Denied. or similar.

    the .cmd is RAN AS ADMIN.

    Cant see where I am going wrong.
    ( which probably means I am doing summet so silly I cant see it )

    Any tips ?

    :cool:
     
  16. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    #17 tnx, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Yes cheers for that info..

    I will give it a go..

    but...

    Regarding what I was doing. Is it totally wrong or what ?
     
  17. s1ave77

    s1ave77 MDL Guide Dog/Dev

    Aug 15, 2012
    15,692
    22,584
    340
    #18 s1ave77, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017

    Yep, in my tests to write the En/Disable script from my sig i found DISM highly uneffective in removing the packages, whereas that ingenious new little EXE did it flawlessly.

    The creators did an amazing job here :worthy:.

    Reminds me to offer manual un/hide and Remove in next version :good3:.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    #19 tnx, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    running that .exe shows me it is "taking ownership"

    I am guessing I would have to do that for the DISM to work.

    It looks pretty good though.

    I just copied the .exe in Sytems32 and ran this little .cmd in my DISM folder
    Code:
    install_wim_tweak.exe /p %~dp0mount  /c Windows-Defender /r
    cheers..
     
  19. tnx

    tnx MDL Expert

    Sep 2, 2008
    1,624
    234
    60
    #20 tnx, Aug 9, 2015
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Well I ran the .exe as stated. It all looked good.

    I have just done a fresh install and Defender was still working.

    DAMN. DAMN.DAMN

    I have just realised what an idiot I am and what the mistake is.

    I mounted the install.wim. Run the .exe.
    Then I copid the install.wim to my USB..

    I DID NOT UNMOUNT THE install.wim and COMMIT the changes....

    WHAT AN IDIOT.......

    Right I will do it again...