1. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    For Windows 7 - Windows 10

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows Security Health\State]
    "AccountProtection_MicrosoftAccount_Disconnected"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications]
    "DisableNotifications"=dword:00000001
    "DisableEnhancedNotifications"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    "DisableAntiVirus"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
    "TamperProtection"=dword:00000000
    "TamperProtectionSource"=dword:00000002
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates]
    "FirstAuGracePeriod"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration]
    "DisablePrivacyMode"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]
    "SecurityHealth"=hex:03,00,00,00,00,00,00,00,00,00,00,00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    "DontReportInfectionInformation"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray]
    "HideSystray"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    "PUAProtection"=dword:00000000
    "RandomizeScheduleTaskTimes"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions]
    "DisableAutoExclusions"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine]
    "MpEnablePus"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine]
    "LocalSettingOverridePurgeItemsAfterDelay"=dword:00000000
    "PurgeItemsAfterDelay"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
    "DisableBehaviorMonitoring"=dword:00000001
    "DisableIOAVProtection"=dword:00000001
    "DisableOnAccessProtection"=dword:00000001
    "DisableRealtimeMonitoring"=dword:00000001
    "DisableRoutinelyTakingAction"=dword:00000001
    "DisableScanOnRealtimeEnable"=dword:00000001
    "DisableScriptScanning"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation]
    "Scan_ScheduleDay"=dword:00000008
    "Scan_ScheduleTime"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting]
    "AdditionalActionTimeOut"=dword:00000000
    "CriticalFailureTimeOut"=dword:00000000
    "DisableEnhancedNotifications"=dword:00000001
    "DisableGenericRePorts"=dword:00000001
    "NonCriticalTimeOut"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan]
    "AvgCPULoadFactor"=dword:00000010
    "DisableArchiveScanning"=dword:00000001
    "DisableCatchupFullScan"=dword:00000001
    "DisableCatchupQuickScan"=dword:00000001
    "DisableRemovableDriveScanning"=dword:00000001
    "DisableRestorePoint"=dword:00000001
    "DisableScanningMappedNetworkDrivesForFullScan"=dword:00000001
    "DisableScanningNetworkFiles"=dword:00000001
    "PurgeItemsAfterDelay"=dword:00000000
    "ScanOnlyIfIdle"=dword:00000000
    "ScanParameters"=dword:00000000
    "ScheduleDay"=dword:00000008
    "ScheduleTime"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates]
    "DisableUpdateOnStartupWithoutEngine"=dword:00000001
    "ScheduleDay"=dword:00000008
    "ScheduleTime"=dword:00000000
    "SignatureUpdateCatchupInterval"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet]
    "DisableBlockAtFirstSeen"=dword:00000001
    "LocalSettingOverrideSpynetReporting"=dword:00000000
    "SpyNetReporting"=dword:00000000
    "SpyNetReportingLocation"=hex(7):30,00,00,00
    "SubmitSamplesConsent"=dword:00000002
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Antimalware-ShieldProvider]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\WinDefend]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MsSecFlt]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sense]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdBoot]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdFilter]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger]
    "Start"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger]
    "Start"=dword:00000000
    
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Security Health\State]
    "AccountProtection_MicrosoftAccount_Disconnected"=dword:00000000
    
    
    For Windows 11

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows Security Health\State]
    "AccountProtection_MicrosoftAccount_Disconnected"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications]
    "DisableNotifications"=dword:00000001
    "DisableEnhancedNotifications"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    "DisableAntiVirus"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
    "TamperProtection"=dword:00000004
    "TamperProtectionSource"=dword:00000002
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates]
    "FirstAuGracePeriod"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configuration]
    "DisablePrivacyMode"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]
    "SecurityHealth"=hex:03,00,00,00,00,00,00,00,00,00,00,00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
    "DontOfferThroughWUAU"=dword:00000001
    "DontReportInfectionInformation"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray]
    "HideSystray"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    "PUAProtection"=dword:00000000
    "RandomizeScheduleTaskTimes"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions]
    "DisableAutoExclusions"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine]
    "MpEnablePus"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine]
    "LocalSettingOverridePurgeItemsAfterDelay"=dword:00000000
    "PurgeItemsAfterDelay"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
    "DisableBehaviorMonitoring"=dword:00000001
    "DisableIOAVProtection"=dword:00000001
    "DisableOnAccessProtection"=dword:00000001
    "DisableRealtimeMonitoring"=dword:00000001
    "DisableRoutinelyTakingAction"=dword:00000001
    "DisableScanOnRealtimeEnable"=dword:00000001
    "DisableScriptScanning"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation]
    "Scan_ScheduleDay"=dword:00000008
    "Scan_ScheduleTime"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting]
    "AdditionalActionTimeOut"=dword:00000000
    "CriticalFailureTimeOut"=dword:00000000
    "DisableEnhancedNotifications"=dword:00000001
    "DisableGenericRePorts"=dword:00000001
    "NonCriticalTimeOut"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan]
    "AvgCPULoadFactor"=dword:00000010
    "DisableArchiveScanning"=dword:00000001
    "DisableCatchupFullScan"=dword:00000001
    "DisableCatchupQuickScan"=dword:00000001
    "DisableRemovableDriveScanning"=dword:00000001
    "DisableRestorePoint"=dword:00000001
    "DisableScanningMappedNetworkDrivesForFullScan"=dword:00000001
    "DisableScanningNetworkFiles"=dword:00000001
    "PurgeItemsAfterDelay"=dword:00000000
    "ScanOnlyIfIdle"=dword:00000000
    "ScanParameters"=dword:00000000
    "ScheduleDay"=dword:00000008
    "ScheduleTime"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates]
    "DisableUpdateOnStartupWithoutEngine"=dword:00000001
    "ScheduleDay"=dword:00000008
    "ScheduleTime"=dword:00000000
    "SignatureUpdateCatchupInterval"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet]
    "DisableBlockAtFirstSeen"=dword:00000001
    "LocalSettingOverrideSpynetReporting"=dword:00000000
    "SpyNetReporting"=dword:00000000
    "SpyNetReportingLocation"=hex(7):30,00,00,00
    "SubmitSamplesConsent"=dword:00000002
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Antimalware-ShieldProvider]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\WinDefend]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MsSecFlt]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sense]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdBoot]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdFilter]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend]
    "Start"=dword:00000004
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger]
    "Start"=dword:00000000
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger]
    "Start"=dword:00000000
    
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Security Health\State]
    "AccountProtection_MicrosoftAccount_Disconnected"=dword:00000000
    
     
  2. sergey130270

    sergey130270 MDL Senior Member

    May 15, 2014
    299
    395
    10
    #22662 sergey130270, May 29, 2022
    Last edited: Sep 8, 2024
    сpasibo
     
  3. maka213

    maka213 MDL Novice

    Aug 24, 2012
    41
    12
    0

    Does it also support 1904X.1706?
     
  4. inTerActionVRI

    inTerActionVRI MDL Expert

    Sep 23, 2009
    1,770
    3,601
    60
    This informed builds are the upper marking of the support. So below these informed builds, should work.

    If you find a problem, please say here on the topic.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    No, Only

    19041.1
    19042.1
    19043.1
    19044.1

    19041.1739
    19042.1739
    19043.1739
    19044.1739


    Usually component removal support is only updated for Patch Tuesday builds but since recent Patch Tuesday builds are having serious issues, this time support for preview builds are added.
     
  6. maka213

    maka213 MDL Novice

    Aug 24, 2012
    41
    12
    0

    How stable would you say the preview is? Maybe it would be worth skipping this month's patching and waiting until next month?
     
  7. ultimate_live

    ultimate_live MDL Expert

    Mar 15, 2011
    1,021
    671
    60
    Can I use DarT from Build 22000 also in 10.0.22621.1?
     
  8. hiepbg

    hiepbg MDL Junior Member

    Nov 29, 2008
    52
    24
    0
    #22669 hiepbg, May 30, 2022
    Last edited: May 30, 2022
    I can not find any iso for 19044.1 . The smallest version is 19044.1288. Can i use it ?
     
  9. ashish.k

    ashish.k MDL Senior Member

    Dec 27, 2014
    303
    136
    10
    #22670 ashish.k, May 30, 2022
    Last edited: May 30, 2022
    You can use builds below the upper limit of the support. I used it with 19044.1706 homebrew ISO and it went fine.

    EDIT: Nope, don't do it.
     
  10. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    Yes by the time the next update to Toolkit is released it will come with next Patch Tuesday update support.
     
  11. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    The debug files are different for 22621 build, if you don't use the crash debugging feature then you can use it.
     
  12. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    Use UUP to make the image and skip select add updates while creating the image.
     
  13. MSMG

    MSMG MDL Developer

    Jul 15, 2011
    6,414
    15,627
    210
    Doing so will break the Windows update to update to next CU.
     
  14. graver.x

    graver.x MDL Senior Member

    Jan 18, 2020
    349
    486
    10
  15. ashish.k

    ashish.k MDL Senior Member

    Dec 27, 2014
    303
    136
    10
    #22676 ashish.k, May 30, 2022
    Last edited: May 30, 2022
    I didn't realize this. Good thing I didn't deploy the build on my PCs yet. Still in VM.

    I also used it on an Enterprise IoT LTSC 19044.1288 ISO from MVS. Seems like it did break updates to newer CUs since I'm getting a 0x800f0988 error when installing updates. Tried a lot of troubleshooting but to no avail. This must be the explanation. Thanks! I'll download 19044.1 and start over.

    EDIT: But how do I get LTSC 19044.1 ISO? Got it for the other editions using above mentioned method.
     
  16. shhnedo

    shhnedo MDL Guru

    Mar 20, 2011
    2,095
    2,866
    90
    All 19044, 19043 and 19042 iso's are 19041 with enablement package. 19041.1 is the base iso for all current windows 10 versions(20h2/21h1/21h2).
     
  17. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    54,966
    125,939
    450
    I think the question is related to this:
    This can't exist, it needs a LCU to be bumped to 19044.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. ashish.k

    ashish.k MDL Senior Member

    Dec 27, 2014
    303
    136
    10
    Right, so what I downloaded was 19041.1. So instead of keeping a build that old I just bit the bullet and used the latest one (as of now, 19044.1739) which is supported by this toolkit for component removal. I will proceed with this but my question is if I wanna do a component removal on LTSC 19044.1288. How can I do that?