Code: AMEngineVersion : 0.0.0.0 AMProductVersion : 4.18.25010.6 AMRunningMode : Not running AMServiceEnabled : False AMServiceVersion : 0.0.0.0 AntispywareEnabled : False AntispywareSignatureAge : 0 AntispywareSignatureLastUpdated : AntispywareSignatureVersion : AntivirusEnabled : False AntivirusSignatureAge : 65535 AntivirusSignatureLastUpdated : AntivirusSignatureVersion : BehaviorMonitorEnabled : False ComputerID : 20203F34-D295-416D-88FF-16B8E14CEF30 ComputerState : 0 DefenderSignaturesOutOfDate : False DeviceControlDefaultEnforcement : Unknown DeviceControlPoliciesLastUpdated : 01/01/1601 01:00:00 DeviceControlState : Unknown FullScanAge : 4294967295 FullScanEndTime : FullScanOverdue : False FullScanRequired : False FullScanSignatureVersion : FullScanStartTime : InitializationProgress : AbortServiceIsStopping IoavProtectionEnabled : False IsTamperProtected : False IsVirtualMachine : True LastFullScanSource : 0 LastQuickScanSource : 0 NISEnabled : False NISEngineVersion : 0.0.0.0 NISSignatureAge : 65535 NISSignatureLastUpdated : NISSignatureVersion : OnAccessProtectionEnabled : False ProductStatus : 1 QuickScanAge : 4294967295 QuickScanEndTime : QuickScanOverdue : False QuickScanSignatureVersion : QuickScanStartTime : RealTimeProtectionEnabled : False RealTimeScanDirection : 0 RebootRequired : False SmartAppControlExpiration : SmartAppControlState : TamperProtectionSource : UI TDTCapable : N/A TDTMode : N/A TDTSiloType : N/A TDTStatus : N/A TDTTelemetry : N/A TroubleShootingDailyMaxQuota : TroubleShootingDailyQuotaLeft : TroubleShootingEndTime : TroubleShootingExpirationLeft : TroubleShootingMode : TroubleShootingModeSource : TroubleShootingQuotaResetTime : TroubleShootingStartTime : PSComputerName : Start-MpScan : Errors were encountered when attempted to scan your device. Au caractère Ligne:1 : 22 + Get-MpComputerStatus;Start-MpScan -ScanType QuickScan;Update-MpSignat ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (MSFT_MpScan:ROOT\Microsoft\...der\MSFT_MpScan) [Start-MpScan], CimExcepti on + FullyQualifiedErrorId : HRESULT 0x80004003,Start-MpScan Update-MpSignature : Virus and spyware definitions update was completed with errors. Au caractère Ligne:1 : 55 + ... terStatus;Start-MpScan -ScanType QuickScan;Update-MpSignature;$null = ... + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (MSFT_MpSignature:ROOT\Microsoft\...SFT_MpSignature) [Update-MpSignature], CimException + FullyQualifiedErrorId : HRESULT 0x80004003,Update-MpSignature Good job !
As mentioned in the post, this work is inspired by the script from TairikuOkami, which, in my humble opinion, used the safest approach to disable Defender without impacting the core functionality of the system. I essentially copied the relevant part of his script and applied it, and it worked for me. Regarding your question, the method is more for those who either prefer not to use Windows Defender at all or have opted for a third-party antivirus instead. As you mentioned, simply disabling DisableAntiSpyware on Windows 10 can often be enough to stop Defender from running. If you're not seeing Defender in your system, then you're probably good without going further into the UI, tray icon, or logging adjustments. That said, for people who want to ensure Defender is entirely out of the picture, these extra steps might be necessary. Hope that clarifies things!
Spared some time in refining the batch scripts to manage services, registry, and scheduled tasks more effectively and seamlessly. The updates focus on enhancing error handling, optimizing performance, and improving overall stability. Here’s a preview of the logs generated by the scripts, highlighting these improvements. They still require thorough testing and a bit of fine-tuning to ensure reliability and robustness. Spoiler: poc Spoiler: when verbose set to 0 Code: [05-04-2025 23:28:26.83] ===== Starting service management process at 23:28:26.78 ===== [05-04-2025 23:28:32.20] [SUCCESS] Service WinDefend stopped successfully [05-04-2025 23:28:32.25] [SUCCESS] Service WinDefend successfully disabled [05-04-2025 23:28:32.37] [SUCCESS] Service WdNisSvc successfully disabled [05-04-2025 23:28:32.51] [SUCCESS] Service WdNisDrv successfully disabled [05-04-2025 23:28:33.14] [SUCCESS] Service WdFilter stopped successfully [05-04-2025 23:28:33.18] [SUCCESS] Service WdFilter successfully disabled [05-04-2025 23:28:33.28] ===== Service management completed at 23:28:33.25 ===== [05-04-2025 23:28:33.28] EXECUTION TIME: 7 seconds [05-04-2025 23:28:33.29] SUMMARY: Processed 5 services - Success: 4, Failed: 0, Skipped: 1 [05-04-2025 23:28:33.31] ERRORS: None Code: [05-04-2025 23:28:33.42] ===== Starting registry modification process at 23:28:33.40 ===== [05-04-2025 23:28:33.47] [SUCCESS] Default User registry hive loaded successfully [05-04-2025 23:28:33.51] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /f [05-04-2025 23:28:33.61] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v AllowFastServiceStartup /t REG_DWORD /d 0 /f [05-04-2025 23:28:33.67] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f [05-04-2025 23:28:33.75] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiVirus /t REG_DWORD /d 1 /f [05-04-2025 23:28:33.82] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableSpecialRunningModes /t REG_DWORD /d 1 /f [05-04-2025 23:28:33.89] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v ServiceKeepAlive /t REG_DWORD /d 0 /f [05-04-2025 23:28:33.97] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine /v MpEnablePus /t REG_DWORD /d 0 /f [05-04-2025 23:28:34.07] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.15] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableIOAVProtection /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.23] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableOnAccessProtection /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.31] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.39] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.47] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.54] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.62] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f [05-04-2025 23:28:34.68] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SpynetReporting /t REG_DWORD /d 0 /f [05-04-2025 23:28:34.75] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SubmitSamplesConsent /t REG_DWORD /d 2 /f [05-04-2025 23:28:34.81] [SUCCESS] Registry Add operation successful: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 23:28:34.87] [SUCCESS] Registry Add operation successful: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 23:28:34.93] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications /v DisableNotifications /t REG_DWORD /d 1 /f [05-04-2025 23:28:35.01] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 23:28:35.07] [SUCCESS] Registry Add operation successful: HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f [05-04-2025 23:28:35.12] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /f [05-04-2025 23:28:35.17] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f [05-04-2025 23:28:35.22] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP /f [05-04-2025 23:28:35.25] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP /f [05-04-2025 23:28:35.29] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP /f [05-04-2025 23:28:35.34] [SUCCESS] Default User registry hive unloaded successfully [05-04-2025 23:28:35.37] ===== Registry modification completed at 23:28:35.34 ===== [05-04-2025 23:28:35.37] EXECUTION TIME: 2 seconds [05-04-2025 23:28:35.37] SUMMARY: Processed 29 operations - Success: 29, Failed: 0, Skipped: 0 [05-04-2025 23:28:35.39] ERRORS: None Code: [05-04-2025 23:29:30.56] ===== Starting scheduled task management process ===== [05-04-2025 23:29:31.25] [SUCCESS] Task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh stopped successfully (now in Ready state) [05-04-2025 23:29:31.37] [SUCCESS] Task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh successfully disabled [05-04-2025 23:29:31.58] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance successfully disabled [05-04-2025 23:29:31.77] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Cleanup successfully disabled [05-04-2025 23:29:31.94] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan successfully disabled [05-04-2025 23:29:32.14] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Verification successfully disabled [05-04-2025 23:29:32.17] ===== Scheduled task management completed ===== [05-04-2025 23:29:32.17] SUMMARY: Processed 5 tasks - Success: 5, Failed: 0 [05-04-2025 23:29:32.19] ERRORS: None [05-04-2025 23:29:32.19] EXECUTION TIME: 1.61 seconds Spoiler: when verbose set to 1 Code: [05-04-2025 21:55:33.84] ===== Starting service management process at 21:55:33.82 ===== [05-04-2025 21:55:33.87] [INFO] Processing service: WinDefend [START] [05-04-2025 21:55:33.91] [INFO] Service WinDefend exists, checking status [05-04-2025 21:55:33.96] [INFO] Service WinDefend is running, stopping it [05-04-2025 21:55:39.15] [SUCCESS] Service WinDefend stopped successfully [05-04-2025 21:55:39.17] [INFO] Disabling service WinDefend [05-04-2025 21:55:39.21] [SUCCESS] Service WinDefend successfully disabled [05-04-2025 21:55:39.23] [INFO] Processing service: WinDefend [END - Status: SUCCESS] [05-04-2025 21:55:39.24] [INFO] Processing service: WdNisSvc [START] [05-04-2025 21:55:39.27] [INFO] Service WdNisSvc exists, checking status [05-04-2025 21:55:39.29] [INFO] Service WdNisSvc is not running, disabling it [05-04-2025 21:55:39.31] [INFO] Disabling service WdNisSvc [05-04-2025 21:55:39.35] [SUCCESS] Service WdNisSvc successfully disabled [05-04-2025 21:55:39.37] [INFO] Processing service: WdNisSvc [END - Status: SUCCESS] [05-04-2025 21:55:39.38] [INFO] Processing service: WdNisDrv [START] [05-04-2025 21:55:39.40] [INFO] Service WdNisDrv exists, checking status [05-04-2025 21:55:39.43] [INFO] Service WdNisDrv is not running, disabling it [05-04-2025 21:55:39.45] [INFO] Disabling service WdNisDrv [05-04-2025 21:55:39.49] [SUCCESS] Service WdNisDrv successfully disabled [05-04-2025 21:55:39.49] [INFO] Processing service: WdNisDrv [END - Status: SUCCESS] [05-04-2025 21:55:39.51] [INFO] Processing service: WdFilter [START] [05-04-2025 21:55:39.54] [INFO] Service WdFilter exists, checking status [05-04-2025 21:55:39.56] [INFO] Service WdFilter is running, stopping it [05-04-2025 21:55:40.20] [SUCCESS] Service WdFilter stopped successfully [05-04-2025 21:55:40.20] [INFO] Disabling service WdFilter [05-04-2025 21:55:40.24] [SUCCESS] Service WdFilter successfully disabled [05-04-2025 21:55:40.26] [INFO] Processing service: WdFilter [END - Status: SUCCESS] [05-04-2025 21:55:40.27] [INFO] Processing service: MDCoreSvc [START] [05-04-2025 21:55:40.29] [INFO] Service MDCoreSvc does not exist, skipping [05-04-2025 21:55:40.31] [INFO] Processing service: MDCoreSvc [END - Status: SKIPPED] [05-04-2025 21:55:40.34] ===== Service management completed at 21:55:40.31 ===== [05-04-2025 21:55:40.34] EXECUTION TIME: 7 seconds [05-04-2025 21:55:40.35] SUMMARY: Processed 5 services - Success: 4, Failed: 0, Skipped: 1 [05-04-2025 21:55:40.35] ERRORS: None Code: [05-04-2025 21:55:40.46] ===== Starting registry modification process at 21:55:40.45 ===== [05-04-2025 21:55:40.48] [INFO] Loading Default User registry hive [05-04-2025 21:55:40.51] [SUCCESS] Default User registry hive loaded successfully [05-04-2025 21:55:40.52] [INFO] Registry Delete operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /f [05-04-2025 21:55:40.56] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /f [05-04-2025 21:55:40.60] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v AllowFastServiceStartup /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.63] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v AllowFastServiceStartup /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.68] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.70] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.73] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiVirus /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.76] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiVirus /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.81] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableSpecialRunningModes /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.82] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableSpecialRunningModes /t REG_DWORD /d 1 /f [05-04-2025 21:55:40.85] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v ServiceKeepAlive /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.88] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v ServiceKeepAlive /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.92] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine /v MpEnablePus /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.93] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine /v MpEnablePus /t REG_DWORD /d 0 /f [05-04-2025 21:55:40.99] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.01] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.06] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableIOAVProtection /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.07] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableIOAVProtection /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.12] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableOnAccessProtection /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.15] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableOnAccessProtection /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.18] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.20] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.26] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.27] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.32] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.34] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.38] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.40] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.45] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.46] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.51] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SpynetReporting /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.52] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SpynetReporting /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.57] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SubmitSamplesConsent /t REG_DWORD /d 2 /f [05-04-2025 21:55:41.60] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet /v SubmitSamplesConsent /t REG_DWORD /d 2 /f [05-04-2025 21:55:41.63] [INFO] Registry Add operation: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.66] [SUCCESS] Registry Add operation successful: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.71] [INFO] Registry Add operation: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.73] [SUCCESS] Registry Add operation successful: HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger /v Start /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.77] [INFO] Registry Add operation: HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications /v DisableNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.79] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications /v DisableNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.84] [INFO] Registry Add operation: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.85] [SUCCESS] Registry Add operation successful: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f [05-04-2025 21:55:41.90] [INFO] Registry Add operation: HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.93] [SUCCESS] Registry Add operation successful: HKU\DefaultUser\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f [05-04-2025 21:55:41.96] [INFO] Registry Delete operation: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /f [05-04-2025 21:55:41.98] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /f [05-04-2025 21:55:42.01] [INFO] Registry Delete operation: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f [05-04-2025 21:55:42.02] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f [05-04-2025 21:55:42.06] [INFO] Registry Delete operation: HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.07] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.09] [INFO] Registry Delete operation: HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.12] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.13] [INFO] Registry Delete operation: HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.15] [SUCCESS] Registry Delete operation successful: HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP /f [05-04-2025 21:55:42.16] [INFO] Unloading Default User registry hive [05-04-2025 21:55:42.18] [SUCCESS] Default User registry hive unloaded successfully [05-04-2025 21:55:42.21] ===== Registry modification completed at 21:55:42.20 ===== [05-04-2025 21:55:42.23] EXECUTION TIME: 2 seconds [05-04-2025 21:55:42.23] SUMMARY: Processed 29 operations - Success: 29, Failed: 0, Skipped: 0 [05-04-2025 21:55:42.24] ERRORS: None Code: [05-04-2025 21:56:37.01] ===== Starting scheduled task management process ===== [05-04-2025 21:56:37.03] [INFO] Processing task: Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh [START] [05-04-2025 21:56:37.07] [INFO] Task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh exists, checking status [05-04-2025 21:56:37.17] [INFO] Current status of Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh is: Ready [05-04-2025 21:56:37.17] [INFO] Task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh is not running, proceeding to disable [05-04-2025 21:56:37.18] [INFO] Disabling task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh [05-04-2025 21:56:37.28] [SUCCESS] Task Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh successfully disabled [05-04-2025 21:56:37.28] [INFO] Processing task: Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh [END - Status: SUCCESS] [05-04-2025 21:56:37.29] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance [START] [05-04-2025 21:56:37.32] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance exists, checking status [05-04-2025 21:56:37.39] [INFO] Current status of Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance is: Ready [05-04-2025 21:56:37.39] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance is not running, proceeding to disable [05-04-2025 21:56:37.41] [INFO] Disabling task Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance [05-04-2025 21:56:37.48] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance successfully disabled [05-04-2025 21:56:37.50] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance [END - Status: SUCCESS] [05-04-2025 21:56:37.51] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Cleanup [START] [05-04-2025 21:56:37.56] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Cleanup exists, checking status [05-04-2025 21:56:37.64] [INFO] Current status of Microsoft\Windows\Windows Defender\Windows Defender Cleanup is: Ready [05-04-2025 21:56:37.65] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Cleanup is not running, proceeding to disable [05-04-2025 21:56:37.65] [INFO] Disabling task Microsoft\Windows\Windows Defender\Windows Defender Cleanup [05-04-2025 21:56:37.76] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Cleanup successfully disabled [05-04-2025 21:56:37.78] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Cleanup [END - Status: SUCCESS] [05-04-2025 21:56:37.79] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan [START] [05-04-2025 21:56:37.82] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan exists, checking status [05-04-2025 21:56:37.87] [INFO] Current status of Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan is: Ready [05-04-2025 21:56:37.89] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan is not running, proceeding to disable [05-04-2025 21:56:37.89] [INFO] Disabling task Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan [05-04-2025 21:56:37.96] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan successfully disabled [05-04-2025 21:56:37.96] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan [END - Status: SUCCESS] [05-04-2025 21:56:37.98] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Verification [START] [05-04-2025 21:56:38.01] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Verification exists, checking status [05-04-2025 21:56:38.06] [INFO] Current status of Microsoft\Windows\Windows Defender\Windows Defender Verification is: Ready [05-04-2025 21:56:38.06] [INFO] Task Microsoft\Windows\Windows Defender\Windows Defender Verification is not running, proceeding to disable [05-04-2025 21:56:38.07] [INFO] Disabling task Microsoft\Windows\Windows Defender\Windows Defender Verification [05-04-2025 21:56:38.14] [SUCCESS] Task Microsoft\Windows\Windows Defender\Windows Defender Verification successfully disabled [05-04-2025 21:56:38.15] [INFO] Processing task: Microsoft\Windows\Windows Defender\Windows Defender Verification [END - Status: SUCCESS] [05-04-2025 21:56:38.17] ===== Scheduled task management completed ===== [05-04-2025 21:56:38.17] SUMMARY: Processed 5 tasks - Success: 5, Failed: 0 [05-04-2025 21:56:38.18] ERRORS: None [05-04-2025 21:56:38.18] EXECUTION TIME: 1.15 seconds