Can't disable Windows Defender via Group Policy or the Registry

Question

I wish to disable Windows Defender on Windows 10 Pro, and I know I have to enable the policy Turn off Windows Defender Antivirus via:

• Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus

This didn't work; Windows Defender, and it's modules, remained active.

• I tried disabling it via the Registry, adding the following key with a value of 1, but received Error while renaming:

  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
  

  I restarted my PC several times, turned it off, unplugged it, all to no avail.

Has Microsoft changed something in the latest release that prevents users from turning Windows Defender off?

Answer 1

I found the solution. It turns out that Windows Defender is so ingrained within Windows 10 that it comes with its own "anti-tamper" protection.

This does two things: prevents you from creating the registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender by giving you a generic error message and also renders the group policy change ineffective.

In order to disable this, I had to follow these instructions:

1. Go to Virus & threat protection
2. Click on Manage Settings
3. Turn off Tamper Protection
4. Proceed to enable the group policy Turn off Windows Defender Antivirus in Computer Configuration/Administrative Templates/Windows Components/Windows Defender Antivirus or add the registry key.
5. Restart PC

Answer 2

In Windows 10 21H1 switching Tampering protection off in Security Center widget and then setting Turn off Microsoft Defender Antivirus policy in gpedit.msc results in:

• Registry setting for this policy DisableAntiSpyware=dword:00000001disappears immediately. Despite that:
• Virus protection does switch off;
• Switching virus protection off retains after rebooting;
• Microsoft Defender's services still run and protect their registry settings so you cannot edit them;
• To switch virus protection back on use Windows Security widget.

So this method switches off virus protection but not Defender's services.

Another way to switch off Microsoft Defender with different results:

1. Disable Windows Security Center (wscsvc) service using registry editor : set "Start" to 4. It is impossible (I didn't manage) to change this value via Services snap-in, "sc" utility etc.
2. Reboot.
3. Run gpedit.msc and set Turn off Microsoft Defender Antivirus policy setting to "On". After few seconds Microsoft Defender Antivirus (WinDefend) service start value automatically changes from 2(auto) to 3(manual).

• Now magically I can edit Microsoft Defender's registry values, protected before disabling Security Center. For example it is now possible to set WinDefend service "Start" value to 4(disabled) as well as other Defender's services e.g. Windows Defender Advanced Threat Protection Service (Sense) etc;
• Turn off Microsoft Defender Antivirus policy and it's registry value retain;
• If I set Security Center service "Start" value back to 2(automatic) and reboot, Turn off Microsoft Defender Antivirus policy setting and it's registry value retain also;
• I cannot switch virus protection back on in Windows Security widget: virus protection settings are now inaccessible. Instead I see that "Your antivirus protection settings are managed by your organization". So policy does work!
• To return all virus protection settings back I must go to gpedit.msc and set Turn off Microsoft Defender Antivirus policy back to "Unconfigured". After some short time registry "Start" value of Microsoft Defender Antivirus (WinDefend) service automatically changes to 2(auto). Then this service starts. Access to virus protection settings in Windows Security widget returns. Registry settings of Defender's services become protected and uneditable again.

This Microsoft article says that Turn off Microsoft Defender Antivirus policy (DisableAntiSpyware=dword:00000001) since recently works only on servers, not on clients. But in fact it works on clients but in pretty sophisticated way:)

Answer 3

Update: After a reboot, realtime protection came back on... So this answer does not work for me. But since it proposes a new method (the registry edit) I'm leaving it here. It could help someone else. Different people seem to have success with different methods.

I also find that updating to 21H1 does not help.

---

For me, it was very difficult to disable Windows Defender in Windows 10 2004 (20H2). I had disabled tamper protection, but still the group policy setting kept being deleted instantly. To see this, one must restart the group policy editor. Also, realtime protection kept being turned on rather quickly when I disabled it.

I was able to overcome this with this registry setting: https://www.tenforums.com/tutorials/5918-how-turn-off-microsoft-defender-antivirus-windows-10-a.html (Search for "Turn_Off_Windows_Defender_Antivirus.reg").

This makes these changes:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001

So it works like this:

1. Disable off tamper protection using the settings panel
2. Also disable realtime protection
3. Apply the registry change
4. Open group policy editor
5. Go to Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus and set `Turn off Microsoft Defender Antivirus" to Enabled (not sure if this is required now)

---

Another option to try is booting into safe mode in order to make the changes: https://www.alitajran.com/turn-off-windows-defender-in-windows-10-permanently/

Answer 4

Another method. Go to Settings, Security, Virus & threat protection, Manage settings, Tamper protection. Set to Off. Then add this:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableRealtimeMonitoring"=dword:00000001

Tested with Windows 10 version 1909

Answer 5

Update March 2022:

• Now the Group Policy method does not work on its own anymore. As soon as you set Turn off Microsoft Defender Antivirus, it turns back on when you restart gpedit.
• However, there is a way to make the change permanent!
• Go to Task Manager -> Performance tab and then open the Open Resource Monitor link on the bottom of the page.
• In the ResMon right-click and suspend MsMpEng.exe and MsMpEngCP.exe
• The go back to the Group Policy editor and do the disabling again.
  • Computer Configuration -> Administrative Templates -> Windows Components -> Microsoft Defender Antivirus and Enable the Turn off Microsoft Defender Antivirus.
• Voila! Now the change is persistent.
• Reboot and enjoy the speed

Answer 6

As of Windows 10 version 2004, the group policy location has moved:

1. turn off tamper protection through defender settings in Windows Settings
2. Open group policy editor
3. Navigate to Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus
4. Turn off defender antivirus

Should work. Note it's now named Microsoft Defender Antivirus rather than Windows Defender now.

Answer 7

USING Group Policy Editor

So, before making any changes to the policy, head over to Task Manager, then to Performance Monitor from the Performance tab. Find MsMpEng.exe in any of the tabs in it (mostly on top in Memory or CPU tabs) and click on Suspend Process.

Then make the changes as required in the Group Policy Editor. It won't get reverted back.

NOTE :- Keep the MsMpEng.exe suspended for as long as you like XD

Answer 8

So, it turns out there's a bug (feature) in the latest Windows 10 21H1 with respect to Windows Defender.

To disable Windows Defender until you manually re-enable it, you need to adjust the group policy TWICE. You don't need to do the regedit but you may still need to disable 'Tamper protection' first.

That's right! Go to Computer Configuration - Administrative Templates - Windows Components - Microsoft Defender Antivirus - and 'Enable' the "Turn off Microsoft Defender Antivirus".

Then Reboot.

Then go through the above steps AGAIN.

After the second reboot, you'll see the system is 'checking' the Defender status but it eventually becomes a red 'X' and you'll see that the service isn't running.

Don't go by the little systray icon being green. It defaults to green but will eventually go to red.

Hope this helps!