[terlisimo]

My preferred way of disabling Windows Defender is to boot Linux, mount windows partition and rename windows defender directories to *.disabled or whatever.

Example (assuming it is mounted at /mnt/ntfs):

mv "/mnt/ntfs/Program Files/Windows Defender" "/mnt/ntfs/Program Files/Windows Defender.disabled"

mv "/mnt/ntfs/Program Files (x86)/Windows Defender" "/mnt/ntfs/Program Files (x86)/Windows Defender.disabled"

mv "/mnt/ntfs/ProgramData/Microsoft/Windows Defender" "/mnt/ntfs/ProgramData/Microsoft/Windows Defender.disabled"

Antivirus service fails to start and that's about it, no other side effects.

To revert just rename back.

I have dual boot set up, but I believe the Ubuntu USB install image supports NTFS.

[atesti]

Windows also contains 3 drivers loaded during boot, all starting with wd*, especially wdboot.sys. If they are loaded, some paths to defender and registry keys are blocked. I always remove them from the custom ISO I use to install windows using dism.exe. You can also reboot into safe mode and rename them. After that, chipping away at defender using takeownership etc. works.

If you just rename the folders, those drivers are probably still active

[gruez]

Wouldn't windows' repair mechanism (dism/sfc) autofix this eventually?

[terlisimo]

Apparently not.

In my first attempt I've actually deleted the directories altogether but later wanted to scan a system manually and I couldn't repair the installation and get WD to run again.

[eddd-ddde]

Is there a reason this doesn't work from windows itself?

[terlisimo]

I've tried once but windows tries really hard not to let you do that.

My Windows kung-fu is rusty these days so the Linux method seemed neater.

[fuzzfactor]

What's happening here is when you boot to something else other than the Windows residing on your main NTFS volume, then your main Windows volume is inactive (its system files are not the ones running) so all those Windows files & folders are dormant, just like any other storage medium. So you can edit the filenames without them being in use at the time, and without your normal Windows processes interfering with the deed.

With Linux you have to be able to access the Windows files for this, and for years now Linux has been able to read & write to the NTFS filesystem decently.

In the Linux example this "disables" the entire Windows Defender folder and everything in it.

In addition to that however, contained in the WinSxS folder you can find some stragglers.

I'll add the belt & suspenders non-Linux equivalent for an up-to-date W11 pro system:

Boot to the Windows startup USB device, you will not select "Install Now" because that is not what is wanted at all. Instead click "Repair" my computer and progress to troubleshooting and the command prompt. This way the terminal CMD window is from a version of "MININT" running straight from a ramdisk in memory, identified as volume X:.

If you need a scratch pad type in "notepad" and it will pop up. Now you have access to your filesystem in "DOS" with a mouse if you need it.

For this disablement, keyboard can be enough in the CMD window, without having to paste lines from a more complex script opened as a text file in notepad. For manual typing though you'd have to type in each of the Rename commands one character at at time with perfection. So you'd probably like the pasting from prefabricated text files more likely.

All your regular Windows folders & files will still be on your main drive, and it will almost always still be identified as C:. Those files are just sitting there dormant and you are like the Trusted Installer, looking down from your perch on X:\.

You may already be just as powerful as Linux now.

Now this just disables the antivirus executable, not the entire folder (the firewall can be controlled from the GUI, but it's not the processor-hog the antivirus is). This is not for PC's in contact with the internet ! :

Rename "c:\program files\windows defender\msmpeng.exe" "c:\program files\windows defender\msmpeng.OFF"

Rename "c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22xxx.xxxx_none_xxxx....xx\msmpeng.exe" "c:\windows\winsxs\amd64_userexperience-desktop_31bf3856ad364e35_10.0.22xxx.xxxx_none_xxxx....xx\msmpeng.OFF"

This second disablement can be the variable one, you need to look in the WinSxS folder in advance while Windows was still running in order to check the "x" values above for your particular build before you would know your particular exact complete WinSxS sub-foldernames. The publickeytoken of 31bf3856ad364e35 may also be subject to change in the future.

Or you can even browse for the target folder in Notepad and rename the file right there using notepad without even typing any commands into the CLI. Even though it would do no good to "open" the executable in notepad, start going through the motions as if you were going to open the EXE file, and you can at least change the name through notepad's limited open/save GUI interface.

If using the correct foldernames, type or paste those two commands into the terminal (one at a time, this is not powershell) and the target executables will be instantly renamed.

When you reboot to your regular Windows, it will not be able to find the msmpeng.exe file when it wants to run it after that. So no Windows antivirus running.

But it hasn't gone away, you can always rename it back to an EXE when you do need it later on.

Based on those two Rename commands you could also reverse the "manual" renaming procedure and effectively toggle the activity of msmpeng.exe, each time using two specific "lines of code" based on the above examples. I guess you could call them very simple scripts.

From what I understand gamers do things like this when PC's are not going on the internet.

[38]

Windows idiotic file permissions are almost impossible to manage, even if you know what you are doing

[SoftTalker]

Seems like I used to be able to do stuff like this from a bash shell under cygwin, but I haven't really used Windows since the XP era.