[DISCUSSION] Disabling Microsoft Defender Antivirus (formerly Windows Defender)

You need to login to view this posts content.

 

No, since smartscreen is a separate component, it can be used with 3rd party AV. I just remove the executable.

Spoiler

Code:

rem Off - Disable Windows SmartScreen / On - Enable Windows SmartScreen
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f

rem 0 - Disable SmartScreen Filter in Microsoft Edge / 1 - Enable
reg add "HKCU\Software\Microsoft\Edge\SmartScreenEnabled" /ve /t REG_DWORD /d "0" /f

rem 0 - Disable SmartScreen PUA in Microsoft Edge / 1 - Enable
reg add "HKCU\Software\Microsoft\Edge\SmartScreenPuaEnabled" /ve /t REG_DWORD /d "0" /f

rem 0 - Disable Windows SmartScreen for Windows Store Apps / 1 - Enable
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t "REG_DWORD" /d "0" /f

rem ________________________________________________________________________________________
reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t "REG_DWORD" /d "0" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t REG_SZ /d "Anywhere" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t "REG_DWORD" /d "0" /f

rem 1 - Enable Microsoft Defender SmartScreen DNS requests
reg add "HKLM\Software\Policies\Microsoft\Edge" /v "SmartScreenDnsRequestsEnabled" /t REG_DWORD /d "0" /f

rem Remove Smartscreen (to restore run "sfc /scannow")
takeown /s %computername% /u %username% /f "%WinDir%\System32\smartscreen.exe"
icacls "%WinDir%\System32\smartscreen.exe" /grant:r %username%:F
taskkill /im smartscreen.exe /f
del "%WinDir%\System32\smartscreen.exe" /s /f /q

 

When I tested the script Smartscreen was showing as disabled in settings.
What does it show in settings on your system? Maybe it shows as disabled but is enabled
Did you run the script from safe mode?

 

Thank you. So this script removes the executable. Do you have a script to revert ?

 

Yes I did.

Spoiler: reputation based protection settings

 

Just run SFC scan.

 

Might be worth disabling Activity History too along with Defender.

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"PublishUserActivities"=dword:00000000

 

Defender remover does not work on Windows 24H2 IoT for Enterprise. I can't find a way to turn it off Defender. Nothing works. Ideas?

 

You need to login to view this posts content.

 

Try my script.. in signature

 

Problem is I can't manually disable Tamper protection it will not open - ‘You’ll Need a New App to Open This Windowsdefender Link’

 

You need to login to view this posts content.

 

Look in my earlier post just disable it using regedit, you need to take ownership of the key before changing to 0

 

it seems that theres a bug in the Iot version...

as for the windows defender...

 

You need to login to view this posts content.

 

Disable in Group Policy Settings (gpedit)?

 

No that is not working, no regedit script working, Defender Remover script not working. You must disable it BEFOR you install OS. Only than working.

 

There are dozens of ways to disable Defender, so you must be doing something wrong. I can enable it, update it and disable it just fine afterwards. Latest Windows and latest platform update.

 

So if you are using malwarebytes on win 10 defender wil not delete any files if in malwarebytes you have said to ignore it ?

 

What is the best way you have found to disable defender? I know there are many ways to disable it. I want to know which way you did it so I can try it.