Disable Windows Defender in Windows 11

Ok, how about this idea (so far on W10 it works)
1.Rename all the Defender Folders by adding letters art the beginning of the folder name and/or at the end of the folders name to confuse the O/S. There are multiple folders in at least 3 locations.
OR-
Rename all the the exc's in all the Defender folders by adding text to just the extension; .exeold is what I use. You can also rename the name of the .exe by adding 'old' or something else; a number for example. Yes it's a bit tedious and you really have to search for all the folders (3 in the root of 'C' and buried in that damn Users folder which is the worst to find anything.
This way, everything is still there, nothing was deleted, just isolated.

BUT, you have to do this from another drive w/ Windows loaded, either another SSD/HDD or a bootable Thumb drive or a bootable DVD since those files are all protected when the O/S is active.

What I haven't done yet is to move (cut & paste) those folders somewhere else (in another drive) with notes where each one was moved from. IOW's basically deleting them from the O/S even thou they aren't deleted. If it's found that something else needs Defender to run which in W10 I haven't found yet, they can be restored by a reverse C&P assuming you have notes where everything goes.Renaming those folders can be almost anything you want, just keep it consistent. A single word or numbers. Renaming the exe's name with a numbers or letters will group the files together so you can find them easier. Folders aren't so bad, there are less of them. Of course, getting rid of them using NT Lite would be better.

I started doing this with certain programs to disable certain functions w/o preventing the program from running; auto updates for example. But sometimes that doesn't work because the writer of the program was a step ahead of me. :oops:
 
I was thinking about disabling it on a running system with no sideffects like the ones I mentioned. I recently found a new tool by SecurityXploded, called "Disable Windows defender". Haven't tried it yet, though.
I believe I read something abut that, it did work, but it doesn't anymore. Another reason I don't like M$'s updates.
 
Renaming the exe's name with a numbers or letters will group the files together so you can find them easier.

I usually rename files with a custom file extension after the original extension - sample.exe.cla -, easy to find in Everything.
If you are renaming files for several different components and you want to differentiate between them try - sample.exe.def - "def" being for defender.

You can rename files with Everything but if you are renaming system files run Everything elevated with Power Run.
 
Last edited:
Renaming Defender folders or files will confuse "SFC /scannow" and "DISM /RestoreHealth", if you ever need to perform a Windows self-repair. Windows will detect specific system files are missing, and attempt to restore them from the WinSxS component store.

This is not the proper approach. If you need to disable Defender, it's better to use a well-reviewed Defender disabler tool than renaming files.
 
As much as I hate M$, I would not rename system files. That's really asking for issues. That doesn't include M$ specific programs as Defender.

16309;​

Great minds think alike. ;)
 
Guys, why are you disabling Defender? I think Defender provides pretty good protection overall. I use Defender myself.
 
Guys, why are you disabling Defender? I think Defender provides pretty good protection overall. I use Defender myself.

If you are not illiterate with computers and use some common sense then defender and every other antivirus is not needed. I myself have not had a infection in over 10 years.

If you are a user who isn't then yes it's necessary but for most here they would rather get there resources back
 
It's another bloated M$ product, what other reason do you need? :mad:
Too many false positives and it strangles your system.
 
It's another bloated M$ product, what other reason do you need? :mad:
Too many false positives and it strangles your system.
Don't think it matters as much with a strong computer but with lower/mid end ones yes it can have an affect. I just want my system to utilize as much as possible with everything I want and get rid of the stuff I don't want on it.

Ntlite was perfect for scratching that need and doing what I needed it to do.
 
Does NtLite have the ability to completely remove Defender and any/all of the Auto Update functions including any 'phone home' spyware (or whatever M$ wants to call them)??
Disabling isn't good enough, it's still there and if it's there they have a way to 'wake' it up again. :mad:

BTW, HDD space is NOT a/the issue either before someone brings that up.
 
I also removed it with W10, I haven't retested since W11,
But there's no reason that should have changed
 
I ran RegistryChangesView, and ended up with this final reg file:
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
"TamperProtection"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
"DisableRealtimeMonitoring"=dword:00000001
"DisableAntiVirus"=dword:00000001

; Microsoft Defender Antivirus Mini-Filter Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter]
"Start"=dword:00000004

 Microsoft Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000004

; Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000004

; Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000004

SUCCESS!! This tweak works even after several reboots. When you bring up the Windows Security control panel, it may take a minute before "Getting protection info..." times out and reports "No active antivirus provider".

Integrate this reg file into the image.
Is this 2026 still the latest tweak one should apply to disable Defender?
 
Hello everyone,

I'm going to integrate Garlin's reg file into my install.wim to disable Windows Defender.

Once Windows 11 is installed, how do I re-enable Defender if needed? I looked in the registry regarding Garlin's reg file, but I don't see how to delete this key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

"DisableAntiSpyware"=dword:00000001
"DisableRealtimeMonitoring"=dword:00000001
"DisableAntiVirus"=dword:00000001
since I don't see it when Defender is enabled.

I modified the other keys:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
"TamperProtection"=dword:00000005

; Microsoft Defender Antivirus Mini-Filter Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter]
"Start"=dword:00000000

Microsoft Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000003

; Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000003

; Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000002

Thank you for your help
 
Restore values taken from a live system:
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=-
"DisableRealtimeMonitoring"=-
"DisableAntiVirus"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
"TamperProtection"=dword:00000001

; Microsoft Defender Antivirus Mini-Filter Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter]
"Start"=dword:00000000 

; Microsoft Defender Antivirus Network Inspection System Driver
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv]
"Start"=dword:00000003

; Microsoft Defender Antivirus Network Inspection Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc]
"Start"=dword:00000003

; Microsoft Defender Antivirus Service
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"Start"=dword:00000003
 
Back
Top