[Solved] Uninstall Windows Defender from Win 10 RS5 1809

Discussion in 'Windows 10' started by Lucas Rey, Oct 4, 2018.

  1. Lucas Rey

    Lucas Rey MDL Member

    Feb 16, 2010
    124
    32
    10
    Hello community,
    I have an issue removing Windows Defender from Windows 10. Until today I thr used intall_wim_tweak with the following command:
    install_wim_tweak.exe /o /c Windows-Defender /r

    Today I updated to build 1809, and it seems that install_wim_tweak.exe dowesn't work anymore.
    Is there any other method to completely uninstall Windows Defender?

    Thank you
    Lucas
     
  2. Atari800XL

    Atari800XL MDL Addicted

    Apr 3, 2011
    954
    1,673
    30
    Are you sure it doesn't work anymore? I used this on a mounted (LTSC2019) install.wim:

    Code:
    install_wim_tweak.exe /p d:\mount /c Windows-Defender /r
    
    So you're saying that doesn't work anymore?
    I also use these reg settings (straight after apply, before first reboot):
    Code:
    [HKEY_LOCAL_MACHINE\temp\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\temp\Microsoft\Windows Defender\Real-Time Protection]
    "DisableRealtimeMonitoring"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\temp\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    

    This does in fact turn off Defender, but I have to admit I haven't really checked if the Install_wim_tweak commands actually "uninstalled"/ removed Defender from the install.wim.
     
  3. Trickz

    Trickz MDL Novice

    Jul 31, 2015
    35
    11
    0
    I use this on a live system, just can't remove Windows Security icon in start menu in 1809
    Code:
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
    reg add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DontReportInfectionInformation /t REG_DWORD /d 1 /f
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /f
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d 1 /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d 1 /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecHealthUI.exe" /v Debugger /t REG_SZ /d "%windir%\System32\taskkill.exe" /f
    install_wim_tweak /o /c Windows-Defender /r
    
     
  4. dani29m

    dani29m MDL Novice

    Oct 6, 2014
    21
    5
    0
    @Lucas Rey make a small .bat with this content in it:
    Code:
    @echo off
    cd /d "%~dp0"
    echo Generating Package List...
    CLS
    install_wim_tweak.exe /o /l
    pause
    Run it as administrator in the same folder where "install_wim_tweak.exe" is. It will create small .txt file with all the current packages.Go trough them and look for windows-deffender...(usually is located on the bottom),this way you'll know if you successfully uninstall it or not.

    @Trickz do same as above and see if there is a package "Microsoft-Windows-SenseClient...." .If there is i think that is what you need to remove to get rid of the Windows Security icon.This is just a guess cause i'm still on LTSB 2016 and haven't mess with the LTSC 2019's packages yet.
     
  5. MS_User

    MS_User MDL Guru

    Nov 30, 2014
    4,617
    1,340
    150
    is that even wise?
     
  6. Enthousiast

    Enthousiast MDL Tester

    Oct 30, 2009
    47,026
    93,874
    450
    Just install using the MRP files, you can almost do all what the choppers want to achieve, only now windows will run stable;)
     
  7. l33tissw00t

    l33tissw00t MDL Addicted

    Dec 6, 2012
    819
    520
    30
    Maybe try this or this.

    P.S. This is not a recommendation. Just helping you find what you may be looking for.
     
  8. MrChris

    MrChris MDL Addicted

    Jun 23, 2007
    532
    127
    30
    Disabling Windows Defender is one thing. Removing such a component and the associated reg entries that is soo backed into the windows os.....not sure thats a good idea. your asking for trouble at some point (windows upgrades, windows updates etc..).

    just my .02 cents

    ~MC
     
  9. Puremin0rez

    Puremin0rez MDL Senior Member

    Nov 24, 2010
    267
    161
    10
    It takes a simple registry key to disable Windows Defender. Hardly worth uninstalling, in my opinion.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. Lucas Rey

    Lucas Rey MDL Member

    Feb 16, 2010
    124
    32
    10
  11. Atari800XL

    Atari800XL MDL Addicted

    Apr 3, 2011
    954
    1,673
    30
    #12 Atari800XL, Oct 5, 2018
    Last edited: Oct 5, 2018
    ,,.and thank you!

    Like you, I have always removed Defender this way (in my case: on offline wim), so to me this does not feel like "chopping", Microsoft could have made this a bit easier to do in the first place.
    I also noticed the icon in the bottom right, removing the "Microsoft-Windows-SenseClient....", as mentioned post #4 of this thread, did not help either.

    But I'm sure the reg tweaks mentioned in your last post will do the trick, I will test as soon as possible. Thanks again for bringing this up, nice to have all the info here in case others need it.

    EDIT: Ahh, the icon was actually easy to get rid of, just a single entry in HKLM\S\M\W\Curr\Run
     
  12. Trenchboygun

    Trenchboygun MDL Member

    Apr 8, 2013
    157
    90
    10
    #13 Trenchboygun, Oct 5, 2018
    Last edited by a moderator: Oct 5, 2018
    i use this for defender
    Code:
    Windows Registry Editor Version 5.00
    
    [-HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\EPP]
    [-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\EPP]
    [-HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\EPP]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "DisableAntiSpyware"=dword:00000001
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=-
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=-
    
    and for command prompt:
    Code:
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t "REG_DWORD" /d "0" /f
    reg add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    reg add "HKLM\SOFTWARE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    reg add "HKLM\SOFTWARE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    reg add "HKLM\SOFTWARE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DontReportInfectionInformation /t REG_DWORD /d 1 /f
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /f
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f
    
    for icon in tray go to task manager -start up- defender -disable
     
  13. dani29m

    dani29m MDL Novice

    Oct 6, 2014
    21
    5
    0
    @Atari800XL "Microsoft-Windows-SenseClient...." is part of the Defender anyway,so,if you already removed the main Defender's packages removing the "SenseClient" will just get rid of a leftover that might cause some feature Cumulative Update to reinstall the Defender.
     
  14. Larus

    Larus MDL Novice

    May 11, 2008
    23
    1
    0
    I have a question regarding this method. Is it possible to reinstall Windows Defender later? Or is it one-way ticket ? :) I tried to search but it's always uninstall procedure described without mention about reinstalling possibility. TIA.
     
  15. palikuca

    palikuca MDL Member

    Oct 23, 2017
    122
    33
    10

    can this be reactivated with a script?

    I did that at the LTSC 2019, defender is gone
     
  16. Lucas Rey

    Lucas Rey MDL Member

    Feb 16, 2010
    124
    32
    10
    Definitely not. As far I know, there is no way to reinstall Defender on a live Windows after removing it. Unless you'll use the upgrade functionality of your Windows 10 untouched DVD.
     
  17. Larus

    Larus MDL Novice

    May 11, 2008
    23
    1
    0
    Thanks Lucas!
     
  18. jinvidia

    jinvidia MDL Member

    Aug 7, 2016
    238
    35
    10
    Do i have to run both the 1st one (reg file) and the 2nd one (batch file ) to completely get rid of this s**tty windows defender ?. Thanks
     
  19. Trenchboygun

    Trenchboygun MDL Member

    Apr 8, 2013
    157
    90
    10
    yes run both