Windows-Defender-Bypass
There are several ways to completely disable Windows Defender. Here's one approach outlining what those methods are.
- Active · last change 12-14-2025
- ★ 1 on GitHub
README
Windows-Defender-Bypass:
Microsoft Defender (formerly known as Windows Defender and Microsoft AntiSpyware) is an antivirus software component from Microsoft that is designed to remove and quarantine malicious software in Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP and was shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials in Windows 8 and later versions.
In March 2019, Microsoft announced Microsoft Defender ATP for Mac for business customers to protect their Mac devices from attacks on a corporate network; a year later, to expand protection for mobile devices, it announced Microsoft Defender ATP for Android and iOS devices, which incorporates Microsoft SmartScreen, a firewall, and malware scanning. The mobile version of Microsoft Defender also includes a feature that blocks access to corporate data if it detects that a malicious app is installed.
This deactivator is only compatible with Windows version build 1703 and later;
all versions below this are not supported.
Features:
Kill Defender Smart Screen:
Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. SmartScreen determines whether a site is potentially malicious by:
- Analyzing visited webpages and looking for indications of suspicious behavior. If Microsoft Defender SmartScreen determines that a page is suspicious, it shows a warning page to advise caution.
- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious.
Windows Defender Service:
The WinDefend service is part of Microsoft Defender Antivirus — a real-time, anti-malware solution distributed with the Windows operating system. On computers where Microsoft Defender is the primary antivirus deployed, the WinDefend service is set to start automatically at boot.
Windows Defender Antivirus Network Inspection Service:
The Microsoft Defender Antivirus Network Inspection Service is running as NT AUTHORITY\LocalService in its own process of NisSrv.exe. It doesn't share its process with other services. If Microsoft Defender Antivirus Network Inspection Service fails to start, the error is logged. Windows 10 startup proceeds, but a message box is displayed informing you that the WdNisSvc service has failed to start.
Microsoft Defender Antivirus Network Inspection Service is unable to start, if the Microsoft Defender Antivirus Network Inspection System Driver service is stopped or disabled.
Windows Defender keep alive off:
keep Windows Defender's real-time protection running (alive), you generally do not need to do anything, as it is designed to run automatically. The setting to turn it off is only temporary; Windows will re-enable it on its own after a short while to ensure your device is protected.
Windows Defender real time monitoring:
Windows Defender Real-time protection is a core feature that continuously scans for malware, viruses, and other threats in real-time, automatically scanning files and apps as they're downloaded or accessed to prevent infections. It's enabled by default in Windows 10/11 and works in the background, though you can manage it in the Windows Security app or via settings for troubleshooting, like when software conflicts occur, by temporarily toggling it on/off or configuring exclusions.
- Continuous Scanning: Actively monitors your device for malicious files and activities.
- Automatic Protection: Scans downloaded files, apps, and system activities without manual input.
- Threat Detection: Identifies and helps remove malware, spyware, and other harmful software.
Windows Defender's Security Health:
Windows Defender's Security Health shows your device's overall protection status, covering antivirus (Microsoft Defender), firewall, and account protection, using the Security Health Service to gather info from Defender and other security apps, indicating if things are up-to-date or compromised, and offering proactive steps for better security, often found within the Windows Security app. Key indicators are the "Up to date" status for antivirus, alerts for misconfigurations, and information on virus scan status, with details available in the Security Center for configuration and troubleshooting.
Key Components of Security Health
- Microsoft Defender Antivirus: Checks if your antivirus definitions (Security Intelligence) are current.
- Firewall: Shows the status of Windows Firewall or any third-party firewall.
- ccount Protection: Reports on sign-in options like Windows Hello or Dynamic Lock.
- App & Browser Control: Manages protections against apps, files, and browsers.
- Device Security: Details features like Core isolation and Trusted Platform Module (TPM).
Windows Defender Tamper Protection:
Windows Defender Tamper Protection is a security feature designed to prevent malicious apps, unauthorized users, or cyber attackers from disabling or altering important Microsoft Defender Antivirus settings. This feature adds an extra layer of defense to maintain the integrity of your device's security configuration.
Key Information:
- Purpose: The main goal is to protect critical security settings from being changed during a cyber attack, ensuring that security features remain active and effective. Threat actors often try to disable endpoint protection systems to facilitate malware installation or data exploitation.
Protected Settings: When Tamper Protection is enabled, specific settings cannot be changed by unauthorized parties, scripts, or registry edits:
- Real-time protection
- Cloud-delivered protection (cloud protection)
- Behavior monitoring
- Security intelligence updates
- Automatic actions on detected threats
- Scanning of archive files
- Availability: It is available on Windows 10 and 11, as well as several Windows Server versions.
- Default State: Tamper Protection is typically enabled by default for all new deployments as part of Windows' built-in protection against ransomware.
- Management: While other apps cannot change the settings when Tamper Protection is on, an administrator can still manage the settings through the Windows Security app on an individual device or via the Microsoft Defender portal/Intune in an organizational setting.
Windows Defender updates:
To disable Windows Defender updates, you generally stop Real-time protection temporarily in Windows Security for immediate needs, but for longer control, use Group Policy Editor (gpedit.msc) to disable Defender itself (Pro/Enterprise) or specific update services via Services Manager (services.msc), or use PowerShell commands like Set-MpPreference -DisableRealtimeMonitoring $true, but it's often automatically re-enabled by Windows unless a third-party antivirus is installed.
Windows bypass trusted installer:
Bypassing TrustedInstaller permissions in the Windows registry generally requires taking ownership of the specific registry key or using elevated tools. There is no simple registry entry that globally disables this protection, as it is a core feature of Windows Resource Protection (WRP) designed to ensure system stability.
To "bypass" the TrustedInstaller in Windows, you must take ownership of the specific file, folder, or registry key you want to modify, and then grant your administrator account full permissions. Direct removal or permanent disabling of the TrustedInstaller service is strongly discouraged as it is a core Windows component designed to protect system stability and security.
The standard method involves changing the ownership from TrustedInstaller to the Administrators group or your specific user account. Warning: Modifying or deleting core system files or registry keys can cause system instability or prevent Windows from functioning correctly. Proceed with caution and ensure you know exactly what you are changing.
There isn't a single "TrustedInstaller registry key path," but rather numerous system keys owned by the TrustedInstaller account, notably under
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\
for component data and
HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller
for the service itself, protecting core system files/settings that only this account (part of Windows Modules Installer Service) manages. To modify these, you must first take ownership and grant permissions to your user account, a risky operation often done via services.msc or advanced security settings in File Explorer/Registry Editor.