Intro:
This article is derived from a Reddit post I made a while back regarding the inability to completely turn off Windows Defender. The link to the Reddit post is located here, however if anything changes to this process after 05/08/22, I will only update this blog post here going forward. If someone happens to delete the Reddit post this document will still exist.
Do yourself a favor and read the entire article before acting.
Problem:
Microsoft Defender Antivirus should be disabled after the setting in Local Group Policy is enabled but for some reason the setting in group policy reverts to "Not Configured". I've restarted and tried over and over again about 4 times now. Initially this is the problem that was occuring, more of a glitch than anything.
I have detailed everything that I have tried as different Windows Updates have come along just as the Reddit post details, however the latest update as of 05/08/22 is number five. So skip to that if you want an answer on how to Disable Windows Defender in Windows 10 build 19044.1682. From the limited testing that I have done, this method will not work on any version of Windows 10 Home.
EDIT: 03/13/23 - Follow Update 6 for Windows 11 Pro & Enterprise
Solution(s):
IF YOU HAPPEN TO COME ACROSS THIS POST PLEASE READ UPDATE #5 BELOW FOR THE LATEST INFORMATION!
Disable Tamper Protection.Restart (shouldn't have to but whatever)gpedit.msc - enable "Turn off Microsoft Defender Antivirus"gpupdate.exeRestart for good measure, refer to #2 ;)
Microsoft Defender Antivirus should be disabled but for some reason the setting in group policy reverts to "Not Configured". I've restarted and tried over and over again about 4 times now. Same problem. This has to be a glitch.
Turn all Defender settings back on via control panel. Verified anything related to Defender is "Not Configured" in group policy.Restart.Disable Tamper ProtectionRestartgpedit.msc - enable "Turn off Microsoft Defender Antivirus"gpupdate.exeRestart agaaaaiiiiiinnnnnnnnNow it works as expected. It took forever (3-4 minutes) for Windows to check it's own setting and come back with....."Getting protection info" when you go into Windows Security.
** UPDATE #3 **
Tried disabling via the registry:
- In the Windows Start menu or search box, enter regedit.exe, and then press Enter.The Registry Editor opens.
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
- In the right pane, right-click in the empty area, and then click New > DWORD (32-bit) Value.
- Enter DisableAntiSpyware, and press Enter.
- Double-click DisableAntiSpyware, and change "Value data" to 1.
- Restart the computer.Windows Defender is now disabled.
Side note: Scratch that idea. M$ disabled doing it this way and deletes the DisableAntiSpyware key for you, own its own🤦♂️: https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware
** UPDATE #6 - 03/13/23 **
Updated this post for Windows 11 Pro & Enterprise. This has been tested with Version 22H2 (OS Build 22621.1344).
--------------------
Ok so here we go & remember we're treating these directions as if Windows Defender was still turned on and has its default settings (Not Configured in gpedit.msc):
--------------------
Windows 11 Pro & Enterprise build # 22621.1344 & Windows Server 2022 21H2 ➡ Turn off "Tamper Protection" ➡ reboot ➡ "gpedit.msc" ➡ (Computer Configuration ➡ Administrative Templates ➡ Windows Components ➡ Microsoft Defender Antivirus ➡ enable "Turn off Microsoft Defender Antivirus) ➡ reboot and wait a few minutes before checking the status of "Virus & threat protection" as you'll see "Getting Protection Info...." when you check the status of Windows Defender in Settings. You're good to go after this and after Getting Protection Info stops loading you'll see the following in the Windows Security dialog box (see image below).
You may need to Toggle the Group Policy key more than once before it actually sets. Ask Microsoft about this one🤷♂️.
Tamper Protection is located here:
Settings ➡ Update & Security ➡ Windows Security (left side) ➡ Virus & threat protection ➡ Virus & threat protection settings ➡ Tamper Protection (4th one down).
The Local Group Policy you're toggling above is located here:
Local Computer Policy ➡ Computer Configuration ➡ Administrative Templates ➡ Windows Components ➡ Microsoft Defender Antivirus ➡ Turn off Microsoft Defender Antivirus
--------------------
Reboot and check Settings ➡ Updates & Security ➡ Windows Security ➡ Virus & threat protection ➡ It should say, "Your Virus & threat protection is managed by your organization" in red. Under that it will say, "No active antivirus provider. Your device is vulnerable".
CTRL + ALT + DELETE ➡ Task Manager ➡ Details ➡ "msmpeng.exe" should not be running after you disable MS Defender. If it's still running please comment back here and I'll try to find a workaround.
If you decide to change the setting in Local Group Policy back to "Not Configured", reboot, wait approximately 5 minutes check status of Windows Defender (some settings will appear to be correct and most aren't), reboot, wait another 2-3 minutes and check again. Windows Defender will turn back on all the settings except Tamper Protection. You need to manually turn that back on. When you check the status again everything will be in the green.
Windows does not need to be activated to make any of the above changes.
Update # 3's side note is still valid in that Windows will delete the 32 bit DWORD key upon reboot.
--------------------
PS: Microsoft I'm tired of beta testing your "final products" and not being paid for it.
Icon at top of post found here: https://icons8.com/icon/A9Yu0Sfpf7h2/windows-defender
👽
No comments:
Post a Comment