Permanently Disable Windows Defender

The last time I installed WIS/ASRA and Xentry, I couldn't keep Windows Defender from restarting after a reboot.

I was using the following method:

1. Disable Tamper Protection
2. Use gpedit to enable Local Computer Policy / Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Turn off Microsoft Defender Antivirus

This used to work, but it no longer survives reboot.

I searched and found a new method that is easy and survives reboot.

1. Disable Tamper Protection
2. Use gpedit to enable Local Computer Policy / Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Real-time Protection / Turn off real-time protection
3. gpupdate / force

After you do this, Windows Security / Virus & thread protection / Virus & threat protection settings will show that Real-time protection is off and it stays off after a reboot.

I did this on Windows 11 IoT Enterprise LTSC Hyper-V VM. I didn't test it running not in a VM.

---

If you're running Windows 11 Home, I attached a screen capture of the registry key. I didn't test it, but I presume it will work the same, although I'm not sure if you can make it stick without gpupdate / force.

you can also use this remover:

Code:

https://github.com/ionuttbara/windows-defender-remover

you can also use this remover:

Code:

https://github.com/ionuttbara/windows-defender-remover

I use this all the time, it works perfect.

I should have also mentioned that to enable Windows Defender, all you have to do is the following:

1. Use gpedit to unconfigure Local Computer Policy / Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Real-time Protection / Turn off real-time protection
2. gpupdate / force

After that, it returns to normal operation.

This method is permanent, but also can be reversed as easily.

Unless it's a system with very limited resources, I prefer to disable only the cloud analysis options, automatic sample upload, and the rest of the options, leaving real-time protection active. On the computers where I have it disabled, nothing gets in without first going through a test computer.

Unless it's a system with very limited resources, I prefer to disable only the cloud analysis options, automatic sample upload, and the rest of the options, leaving real-time protection active. On the computers where I have it disabled, nothing gets in without first going through a test computer.

The reason I like to be able to enable real-time protection is because I prefer to only have it disabled when it needs to be disabled. Otherwise, I exclude the specific file or folder, then enable it.

Here is Defender Control

You can turn it on/off

The last time I installed WIS/ASRA and Xentry, I couldn't keep Windows Defender from restarting after a reboot.

I was using the following method:

1. Disable Tamper Protection
2. Use gpedit to enable Local Computer Policy / Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Turn off Microsoft Defender Antivirus

This used to work, but it no longer survives reboot.

I searched and found a new method that is easy and survives reboot.

1. Disable Tamper Protection
2. Use gpedit to enable Local Computer Policy / Computer Configuration / Administrative Templates / Windows Components / Microsoft Defender Antivirus / Real-time Protection / Turn off real-time protection
3. gpupdate / force

After you do this, Windows Security / Virus & thread protection / Virus & threat protection settings will show that Real-time protection is off and it stays off after a reboot.

I did this on Windows 11 IoT Enterprise LTSC Hyper-V VM. I didn't test it running not in a VM.

---

If you're running Windows 11 Home, I attached a screen capture of the registry key. I didn't test it, but I presume it will work the same, although I'm not sure if you can make it stick without gpupdate / force.

Download DefenderControl from Sordum