Has anyone found a way to disable Windows Defender in Windows 11 ?

SIW2 · Jul 3, 2021

Install free 3rd party a/v and turn off its realtime protection temporarily as required. Does that do it?

TairikuOkami · Jul 3, 2021

SIW2 said:
Install free 3rd party a/v and turn off its realtime protection temporarily as required. Does that do it?

Hard to say, I think Windows 10 Dev managed to turn on Defender once, even though it's services where disabled.
I do not need AV, I keep Panda as Defender's disabler. It is easier and it helps to avoid BSOD critical service died.

jimbo45 · Jul 5, 2021

Hi there
works for me OK (on W11 Enterprise -- released version not the "leaked one" -- just go into settings-->security

same as for standard W10 etc. It's just the settings options are stupidly arranged in W11 -- just search on windows defender or security.

Seems to do the trick

Re-enabled it again of course.

Cheers
jimbo

abactuon · Jul 10, 2021

Found on github (not English) script
I don't have Windows 11 to test.

"In Windows 11, group policies no longer work, you have to forcibly disable the defender service to disable it."

devxexec.exe /user:SYSTEM Script.bat

devxexec.exe :

Download DevxExec 1.16

Download DevxExec - Run a process from the windows service under another user credentials

www.softpedia.com

Start as Admin :

devxexec.exe /user:SYSTEM Script.bat

Script.bat :

@echo off
echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService [1] >> %TEMP%\reg_perm.LOG
regini "%TEMP%/reg_perm.LOG"
del %TEMP%\reg_perm.LOG /q

:nashalo
Echo ============ Choose: ============
Echo Off Windows Defender - 0
Echo On Windows Defender - 1
Set /p vibor="Number: "

if "%vibor%"=="0" (
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 4 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
) else if "%vibor%"=="1" (
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 2 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 2 /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
) else (
Echo Wrong! & goto nashalo
)

goto nashalo
pause >nule >nul

swarfega · Jul 11, 2021

Is there a reason why you want to disable the security?

abactuon · Jul 11, 2021

Such software consumes much of the system resources and CPU resources (some up to 30% or more). There is no need to use such software if you do not often access some junk sites. Not using such security software is much more practical and convenient than overclocking the CPU.

Ghot · Jul 11, 2021

user655362020 said:
What I have tried :

Tamper protection was disabled when I tried below mentioned things :

1. Suspend MsMpEng.exe from Resource Monitor and enable Turn off Microsoft Defender Antivirus Group policy. The policy reverts itself after reboot.
2. Use WinAero Tweaker.
3. Defender Control

The Antimalware Service Executable is still running.

This works on Windows 10, and probably works on Windows 11 too.
The benefit to using Autoruns, is that things are easy to do and undo.

Anyway... if you uncheck the boxes shown, you will be able to stop the Microsoft Defender and the Windows Defender Services.
Stopping the Services is what stops Defender.

You need to set the Autoruns Options as shown in the lower right.
The choose: the Everything tab, and then type windows defender in the search box.

Autoruns for Windows - Windows Sysinternals

This worked like a charm on Windows 10.
It does break Windows Updates, but... you can turn Defender back on, any time you want to check for updates.
This didn't permanently break anything on Windows 10.

Ofc, you should make a full OS image backup before "trying" anything.

JAM83 · Jul 11, 2021

TairikuOkami said:
AV is pretty much a requirement in 11, just like TPM. If you disable 3rd part AV temporarily, Defender kicks in (when not disabled).

I disabled it through Group Policy Editor.

Sammy888 · Feb 18, 2022

JMedlock83 said:
I disabled it through Group Policy Editor.

I read elsewhere that doesn't work. Microsoft did a lot of changes recently with Windows 11. Previously, this third party utility was used (successfully) but it's now broken.

Brink · Feb 18, 2022

Hello,

You would need to turn off Tamper Protection first, then you will be able to disable or turn off Microsoft Defender Antivirus if wanted.

Turn On or Off Tamper Protection for Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to turn on or off Tamper Protection for Microsoft Defender Antivirus settings in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. Tamper...

www.elevenforum.com

Enable or Disable Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to enable or disable Microsoft Defender Antivirus in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. You must be signed in as an...

www.elevenforum.com

Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to enable or disable real-time protection for Microsoft Defender Antivirus in Windows 10 and Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 10/11 and can help protect your device from viruses, malware, and other...

www.elevenforum.com

ThrashZone · Feb 18, 2022

Hi,
I use this in cmd as admin

Code:

rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f

JAM83 · Feb 18, 2022

Sammy888 said:
I read elsewhere that doesn't work. Microsoft did a lot of changes recently with Windows 11. Previously, this third party utility was used (successfully) but it's now broken.

Works for me, and still does.

Sammy888 · Feb 19, 2022

ThrashZone said:

Hi,
I use this in cmd as admin

Code:

rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f

Is there a bat file for this and a reversal too?

JMedlock83 said:
Works for me, and still does.

Could it be because your're using Windows 11 Pro and not Home?

I noticed that many existing features (mods) continue to work after upgrading from W10 to W11 but won't necessarily work with a clean installation of W11?

Sammy888 · Feb 19, 2022

Brink said:
Hello, :)

You would need to turn off Tamper Protection first, then you will be able to disable or turn off Microsoft Defender Antivirus if wanted.

Turn On or Off Tamper Protection for Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to turn on or off Tamper Protection for Microsoft Defender Antivirus settings in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. Tamper...

www.elevenforum.com

Enable or Disable Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to enable or disable Microsoft Defender Antivirus in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. You must be signed in as an...

www.elevenforum.com

Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to enable or disable real-time protection for Microsoft Defender Antivirus in Windows 10 and Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 10/11 and can help protect your device from viruses, malware, and other...

www.elevenforum.com

Hi Brink, so can you confirm the tutorial is still valid?

And that the instructions in fact disable MsMpEng.exe?

Stigg · Feb 19, 2022

Sordum Defender Control is still working for me.

Defender Control v2.1

In Windows there is no option to completely turn off Microsoft Defender , Defender control is a Portable freeware to disable Ms Defender.

www.sordum.org

Sammy888 · Feb 19, 2022

Stigg said:
Sordum Defender Control is still working for me.

Defender Control v2.1

In Windows there is no option to completely turn off Microsoft Defender , Defender control is a Portable freeware to disable Ms Defender.

www.sordum.org

Ok, Now I'm very concerned. The comments on the site specifically say Sordum is broken. I can confirm that's the case too.

Stigg · Feb 19, 2022

Sammy888 said:
Ok, Now I'm very concerned. The comments on the site specifically say Sordum is broken. I can confirm that's the case too.

Where do any current comments say that it's broken?
I have even put my glasses on and can't see any. I am assuming you're using Windows 11.
Did you add it to the Exclusion List from the menu? There are plenty of dummies that post on that site.

It is working fine for me.
It's a standalone program. Nothing to install.

TairikuOkami · Feb 19, 2022

Installing AV (Adaware), disabling Defender, uninstalling AV, it still works with the latest version 4.18.2201.10.

Brink · Feb 19, 2022

Sammy888 said:
Hi Brink, so can you confirm the tutorial is still valid?

And that the instructions in fact disable MsMpEng.exe?

It disabled Microsoft Defender Antivirus in the Windows Security app at the time the tutorial was created.

ThrashZone · Feb 19, 2022

Sammy888 said:
Is there a bat file for this and a reversal too?

Hi,
Nope

MS updates do a good job of undoing stuff related to disabling defender lol

Has anyone found a way to disable Windows Defender in Windows 11 ?

Well-known member

My Computers

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computer

sʍɐɹɟǝƃɐ

My Computers

Well-known member

My Computer

Well-known member

My Computers

iRacing Broadcaster for MaxspeedTV

My Computers

Well-known member

My Computer

Administrator

My Computers

Minor Threat

My Computer

iRacing Broadcaster for MaxspeedTV

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Microsoft 365 Basic

Attachments

My Computer

Administrator

My Computers

Minor Threat

My Computer

Similar threads