Has anyone found a way to disable Windows Defender in Windows 11 ?

Sammy888 · Feb 19, 2022

Brink said:
It disabled Microsoft Defender Antivirus in the Windows Security app at the time the tutorial was created.

Ok. That doesn't work for me. The two applications that remain continuously running in the background in W11 Home 21H2 are:
MsMpEng.exe
MsMpEngCP.exe

Additionally, I don't want to have to go to the Group Policy Editor (which doesn't natively exist in Windows Home) each time I want to enable it. This is why I liked using Defender Control v2.0. You can enable and disable it completely on demand, until it became broken after reinstalling Windows.

CornishRattler · Feb 19, 2022

I just disabled it :ROFLMAO:

Stigg · Feb 19, 2022

I am running Windows 11 Version 21H2 Build 22000.527.
This is what I get when I disable Windows Defender using Sordum Defender Control.

It appears to completely disable it for me and never bothers me anymore and no more intensive resource usage.
I am baffled why some of you are saying that it doesn't work.

In the past I've used registry edits and removing services and files, but this is such a simple and effective fix.

If you have Sordum Defender Control sitting on your C: Drive, you have to ensure that it has full control permissions.
Save it in a sub-folder and the give the sub-folder full control permissions. Make sure there isn't another copy in another location.

JAM83 · Feb 23, 2022

Sammy888 said:
Is there a bat file for this and a reversal too?

Could it be because your're using Windows 11 Pro and not Home?

I noticed that many existing features (mods) continue to work after upgrading from W10 to W11 but won't necessarily work with a clean installation of W11?

I'm using a fresh install of Windows 11 Pro

JAM83 · Feb 23, 2022

Stigg said:
Sordum Defender Control is still working for me.

Defender Control v2.1

In Windows there is no option to completely turn off Microsoft Defender , Defender control is a Portable freeware to disable Ms Defender.

www.sordum.org

You can turn off Windows Defender by using the Group Policy Editor (Windows Pro). I don't think Windows Home as GPEditor

Wisewiz · Feb 24, 2022

Stigg said:
I am running Windows 11 Version 21H2 Build 22000.527.
I am baffled why some of you are saying that it doesn't work.

I have the same build and the same Sordum Defender Control, and it no longer works. Maybe I have a newer version of Defender than you. Here's what the Sordum site has to say (and this appeared after the last Defender update):

Stigg · Feb 24, 2022

Wisewiz said:
I have the same build and the same Sordum Defender Control, and it no longer works. Maybe I have a newer version of Defender than you. Here's what the Sordum site has to say (and this appeared after the last Defender update):
View attachment 22848

Hi Wisewiz.

Mine is still working.
Did you try what danrevella posted in the comments section?

For me it does work in this fashion:
1) Go to settings windows defender and turn off potentially unwanted application (PUA).
2) Restart your computer and run defender control, it will disable Windows defender.

paulhatton · Feb 24, 2022

I have permanently disabled Defender in both win 10 and 11 with the use of Take Ownership utility, safe boot and in Win 11 pro gpedit.msc.
It has never ever come back and I have deleted all the folders too other than c\program files\windows defender where only 2 dll's would not go but I have renamed them also used autorun organiser excellent program.

paulhatton · Feb 24, 2022

It was just pure experimentation and general there must be away it does involve repetition but it has not let me down but in all honesty I will be typing for ever if I fully run through it and life a bit short at 70plus for that guys !!
It has worked as I said in both Win 10 and 11 and to be fair that last folder can be deleted again in Safe Mode but yawn there's more to life !!
Bye............

Thanks.

Wisewiz · Mar 3, 2022

Stigg said:
Hi Wisewiz.

Mine is still working.
Did you try what danrevella posted in the comments section?

@Stigg : No need. The Sordum people in Germany re-worked it and released v 2.1 yesterday. Once you get through all of the unzipping and use the password Sordum has provided on the site to get to the final naked files, you can replace the exe and ini in your Program Files (x86)\Defender Control folder with those for 2.1, and it's all joy from there on out.

I did find that I had to restart Windows to get the Defender icon back in the tray after using the utility to disable and then re-enable Defender, but no hiccups aside from that.

Works perfectly, and lets me use Disk Cleanup to wipe the ever-growing pile of files Defender stores.

reidalow · Mar 7, 2022

No need to use any proprietary software.
Restart in safe mode and rename the files within these folders:
%Programfiles%\windows defender
%Programfiles%\Windows Defender Advanced Threat Protection
%Programfiles% (x86)\Windows Defender
%ProgramData%\Microsoft\Windows Defender
%ProgramData%\Microsoft\Windows Defender\Platform
%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection

regedit, set the key "Start" to 4 in all these:
SYSTEM\CurrentControlSet\Services\WdBoot
SYSTEM\CurrentControlSet\Services\WdFilter
SYSTEM\CurrentControlSet\Services\WdNisDrv
SYSTEM\CurrentControlSet\Services\WdNisSvc
SYSTEM\CurrentControlSet\Services\WinDefend
SYSTEM\CurrentControlSet\Services\wscsvc
SYSTEM\CurrentControlSet\Services\SecurityHealthService
SYSTEM\CurrentControlSet\Services\Sense
SYSTEM\ControlSet001\Services\WinDefend

some may require take you take ownership of the registry, i think it only this one:
SYSTEM\CurrentControlSet\Services\WinDefend

Restart the pc in safe mode - AGAIN
do everything again

Stigg · Mar 8, 2022

reidalow said:
No need to use any proprietary software.
Restart in safe mode and rename the files within these folders:
%Programfiles%\windows defender
%Programfiles%\Windows Defender Advanced Threat Protection
%Programfiles% (x86)\Windows Defender
%ProgramData%\Microsoft\Windows Defender
%ProgramData%\Microsoft\Windows Defender\Platform
%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection

That's a lot of file renaming to do inside those folders.
Could you not simply just rename the folders?

reidalow · Mar 8, 2022

Stigg said:
That's a lot of file renaming to do inside those folders.
Could you not simply just rename the folders?

No, specially on the first pass there will always be some files locking most folders. Renaming the files will break several defender modules and kernel-level drivers until it wont work anymore but will not break the OS. Microsoft design it to be impossible for the user to disable, even with another AV running, the defender will still consume several cpu and disk cycles.
My method is probably the only one that complete removes defender, even the kernel-level drivers.

Stigg · Mar 8, 2022

reidalow said:
No, specially on the first pass there will always be some files locking most folders. Renaming the files will break several defender modules and kernel-level drivers until it wont work anymore but will not break the OS. Microsoft design it to be impossible for the user to disable, even with another AV running, the defender will still consume several cpu and disk cycles.
My method is probably the only one that complete removes defender, even the kernel-level drivers.

I used to manually disable it a while back.

I'd delete all the Services and loading points in the Registry and scheduled tasks.
I think I may have even documented it myself on the Windows 10 Forums, but Sordum Defender Control made me lazy.

Where I really found the need to disable it was on older computers that I used to work on.
For some reason, it can be a HUGE resource hog on some older computers.
The only solution I found to make them usable was to disable it.

Sammy888 · Mar 8, 2022

Wisewiz said:
@Stigg : No need. The Sordum people in Germany re-worked it and released v 2.1 yesterday. Once you get through all of the unzipping and use the password Sordum has provided on the site to get to the final naked files, you can replace the exe and ini in your Program Files (x86)\Defender Control folder with those for 2.1, and it's all joy from there on out.

I did find that I had to restart Windows to get the Defender icon back in the tray after using the utility to disable and then re-enable Defender, but no hiccups aside from that.

Works perfectly, and lets me use Disk Cleanup to wipe the ever-growing pile of files Defender stores.

View attachment 23391

I can confirm this works; however, my PC randomly behaves "weird" after I enabled it.

For instance, when I restarted my PC, I had an odd screen come up instead of my desktop after I entered my PIN. It took a long time to appear when normally it's almost instant to get to my desktip. The screen can be described similar to the old W10 widget screen showing apps like Office, Edge, and more. In my case, I have those Windows Store apps uninstalled and the icon shouldn't appear. I went ahead and disabled and uninstalled WD 2.1 and performed a restore point which seemed to fix the problem.

I installed it again earlier today and my PC lost it's Ethernet connection, and it returned on its own after I disabled WD 2.1 (enabled Windows Defender).

I suspect Windows Defender in W11 is similar to Microsoft Edge WebView2, and it needs to be enabled and running all the time.

TairikuOkami · Mar 8, 2022

reidalow said:
Restart in safe mode and rename the files within these folders:

That is a bit streching it, it might result in BSOD Critical Process/Service died.

reidalow said:
SYSTEM\CurrentControlSet\Services\Sense

This service no longer exists on 11.

reidalow said:
SYSTEM\CurrentControlSet\Services\wscsvc
SYSTEM\CurrentControlSet\Services\SecurityHealthService

This will disable security center and notification center. It has nothing to do with Defender.

reidalow said:
SYSTEM\CurrentControlSet\Services\WdBoot

Disabling WdBoot.sys and WdFilter.sys is not necessary, they will stop automatically, Windows is touchy if drivers are disabled.

Culbrelai · Mar 19, 2022

reidalow said:
No need to use any proprietary software.
Restart in safe mode and rename the files within these folders:
%Programfiles%\windows defender
%Programfiles%\Windows Defender Advanced Threat Protection
%Programfiles% (x86)\Windows Defender
%ProgramData%\Microsoft\Windows Defender
%ProgramData%\Microsoft\Windows Defender\Platform
%ProgramData%\Microsoft\Windows Defender Advanced Threat Protection

regedit, set the key "Start" to 4 in all these:
SYSTEM\CurrentControlSet\Services\WdBoot
SYSTEM\CurrentControlSet\Services\WdFilter
SYSTEM\CurrentControlSet\Services\WdNisDrv
SYSTEM\CurrentControlSet\Services\WdNisSvc
SYSTEM\CurrentControlSet\Services\WinDefend
SYSTEM\CurrentControlSet\Services\wscsvc
SYSTEM\CurrentControlSet\Services\SecurityHealthService
SYSTEM\CurrentControlSet\Services\Sense
SYSTEM\ControlSet001\Services\WinDefend

some may require take you take ownership of the registry, i think it only this one:
SYSTEM\CurrentControlSet\Services\WinDefend

Restart the pc in safe mode - AGAIN
do everything again

This actually works, but I did not rename anything just set the regedit keys to 4.
Finally no more windows defender uselessly slamming my hard drives. I actually got a popup in the notification center telling me to turn defender back on so you know it works. I wish I would have screenshotted it.

reidalow · Mar 21, 2022

Culbrelai said:
This actually works, but I did not rename anything just set the regedit keys to 4.
Finally no more windows defender uselessly slamming my hard drives. I actually got a popup in the notification center telling me to turn defender back on so you know it works. I wish I would have screenshotted it.

Great, i would keep monitoring because i think that if you dont rename the files, some defender applications may be called in a very specific situations like after a browser download.

Has anyone found a way to disable Windows Defender in Windows 11 ?

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

iRacing Broadcaster for MaxspeedTV

My Computers

iRacing Broadcaster for MaxspeedTV

My Computers

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Well-known member

My Computers

Active member

My Computer

Active member

My Computer

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Member

My Computer

Member

My Computer

Similar threads