10

I'm running a huge sync job and Microsoft Windows Defender is hogging a ton of memory and creating a lot of disk I/O requests on my drive as well.

I know how to disable Windows Defender but I do not want to reboot my PC while this sync in going on to disable it. I also turned off real-time protection but that did not accomplish freeing the memory up like I expected. I really just need to stop the MsMpEng.exe application.

Is it possible to temporarily stop Windows Defender application and then start it again without needing to reboot the PC?

Improve this question
2
  • So how do you suspend the wretched thing With a reboot. The idea of running some unknown software from the web to suspend anti virus does not feel like a good idea.
    – Tuntable
    Aug 2, 2019 at 10:04
  • I think your missing the point to my question @tuntable because I'm not trying to "suspended with a reboot". The whole point was for me to free up the memory. I wanted to suspend the antivirus so that I could gain that memory back. A reboot would do this but I wanted to avoid a reboot because I was in the middle of a large copy job. And at what point do you think that I am trying to run some "unknown software"? I never said anything like that at all. I think you just got the wrong idea about my question. There are many situations when one would want to stop antivirus software.
    – Arvo Bowen
    Aug 2, 2019 at 11:44

1 Answer 1

Reset to default
7

A Step-by-Step Guide to Temporarily Disabling Windows Defender and then Re-Enabling it on Windows 10

Initial One-Time Setup #1 - #4 per PC

1. Make a Windows Defender Folder Exclusion

  • First to start, create a new folder on your "C" drive or somewhere you can access and name it DefenderExclusions.

  • Press the Windows Key one time, start typing "Windows Defender" and click it once you see it. Windows Defender

  • From Windows Defender click on Settings enter image description here

  • Go to Windows Defender and in the Exclusions area click the "Add an exclusion option" enter image description here

    • Click the "Exclude a folder" option

    enter image description here

    • Select the DefenderExclusions folder location you created above when the Select Folder window opens and then select the "Exclude this folder" option enter image description here

2. Download the NoDefender App

  • Download the NoDefender App and it should save as a zip file named NoDefender.zip. enter image description here

  • Open the NoDefender.zip file and then right-click and select Copy on the file within it named NoDefender.exe

  • Go to the DefenderExclusions folder location you created and setup the Windows Defender Exclusion, right-click and then paste to save the NoDefender.exe into this folder.

3. Create Disable Defender Script

  • Save the below logic to a text document in the DefenderExclusions and name it to DisableDefender.cmd

DisableDefender.cmd Script

@ECHO ON

"%ProgramFiles%\Windows Defender\MSASCui.exe"
PING -n 3 127.0.0.1 > nul
"C:\DefenderExclusions\NoDefender.exe"

GOTO :EOF

4. Create Enable Defender Script

  • Save the below logic to a text document in the DefenderExclusions and name it to EnableDefender.cmd

EnableDefender.cmd Script

@ECHO ON

sc start WinDefend enable
PING -n 3 127.0.0.1 > nul
NET START "WdNisSvc"
PING -n 3 127.0.0.1 > nul
NET START "WinDefend"
PING -n 3 127.0.0.1 > nul
"%ProgramFiles%\Windows Defender\MSASCui.exe"

GOTO :EOF

Disabling Windows Defender

  1. Double-click the DisableDefender.cmd batch file saved in the DefenderExclusions location setup previously.

  2. When Windows Defender opens, click on the Settings option and be sure the Windows Defender option is selected on the left.

    enter image description here

  3. Turn off Real-Time Protection, Cloud-based Protection, and the Automatic sample submission options. enter image description here
  4. It is expected to see the warning message pop up in the lower right-hand corner of the task bar indicating that Spyware and unwanted software protection may be disabled with the red X. enter image description here
  5. You will notice the Windows Defender app screen is more red than green now, the PC Status: At risk is showing, and the Real-time protection is off; just minimize that window for now. enter image description here
  6. Double-click the NoDefender.exe file previously saved in the DefenderExclusions location. If the User Account Control message pops up select the Yes option to run it
  7. Select Next in the NoDefender app window enter image description here
  8. Select Next again in the NoDefender app window enter image description here
  9. Click on the Disable Window Defender option in the NoDefender app window and then select the Next option. enter image description here
  10. You should then see the NoDefender app window saying it's Done and that Window Defender should be disabled, select the Exit option. enter image description here
  11. Now if you go back to the Windows Defender app window, you should notice that the Virus and spyware definitions with an Out of date status enter image description here
  12. Now it is time to run the process(es) or whatever that needs to run with Windows Defender being disabled. Let everything finish and then once you are ready to re-enable Windows Defender, follow the Enabling Windows Defender section below.

Enabling Windows Defender

  1. Double-click the EnableDefender.cmd batch file saved in the DefenderExclusions location setup previously and give it a few seconds to finish and pop up the Windows Defender app window.

  2. When the Windows Defender app window opens you should notice the Real-time protection is On and the Virus and spyware definitions have a value of Up to date now.

  3. You want to select the Settings option from the Windows Defender app window again. enter image description here

  4. Turn On Real-Time Protection, Cloud-based Protection, and the Automatic sample submission options. enter image description here

Now Windows Defender is re-enabled again.

As per the comment:

The point of this question was to actually start the application over again causing it to release it's hold on all the memory it has consumed. I have used registry entries that will stop the WD application from running but that requires a reboot. I disable WD (real-time protection) by just going into settings and turning off real-time protection. If real-time protection is off WD is disabled, if MsMpEng.exe is not running, WD is stopped. – Arvo Bowen

Testing Results of MsMpEng.exe Before and After Running the Process

Below is a screen shot of the results of the command line of tasklist | FIND /I "ms" which shows whether or not the MsMpEng.exe process is running in memory. This process appears to kill the process from memory when it's disabled, and it appears to have it start back up and running in memory when it's enabled.
enter image description here

As per the comment:

OK so following these steps SOME of the results are true. 1) When I click the "Disable Windows Defender" button, WD has two messages (real-time and Antivirus protection) is turned off. After two seconds the Antivirus message disappears and only the real-time is left. Also, Virus and spyware definitions still show up to date (green check). – Arvo Bowen

I went ahead and downloaded the latest version of the NoDefender.exe app and triple-checked the process and it's working just as I wrote about above. If for some reason you do not follow the steps in the order I wrote, then it may not work as I wrote. In particular, you MUST complete the steps defined in the Disabling Windows Defender section for #3 and turn all three of those to Off before you run the NoDefender.exe app disabling process.

Improve this answer
8
  • GREAT write-up! After you run the NoDefender application does that actual STOP the MS Defender application (not just disable the mechanics)?
    – Arvo Bowen
    Jul 6, 2016 at 16:45
  • Yea, I'm sure it does but my concern is that it's just "disabling" the application as opposed to "stopping" the application. The point of this question was to actually start the application over again causing it to release it's hold on all the memory it has consumed. I have used registry entries that will stop the WD application from running but that requires a reboot. I disable WD (real-time protection) by just going into settings and turning off real-time protection. If real-time protection is off WD is disabled, if MsMpEng.exe is not running, WD is stopped.
    – Arvo Bowen
    Jul 6, 2016 at 16:58
  • Until I confirm the MsMpEng.exe application stops I don't want to give the check yet. But you have defiantly earned the +1 from me for your time spent on a great answer that is very helpful!
    – Arvo Bowen
    Jul 6, 2016 at 16:59
  • OK so following these steps SOME of the results are true. 1) When I click the "Disable Windows Defender" button, WD has two messages (real-time and Antivirus protection) is turned off. After two seconds the Antivirus message disappears and only the real-time is left. Also, Virus and spyware definitions still show up to date (green check).
    – Arvo Bowen
    Jul 6, 2016 at 17:13
  • I'm using Win10 Pro, didn't you say you were using Win10 Home? Maybe that's the reason? It's just not killing "MsMpEng.exe" for me. Maybe it will if I restarted or something. Virus and spyware definitions are always "up to date". But you have went way and beyond answering this question with proof it is working for you so the check is yours! At this point my sync job is done and it's really a moot point for me. Thanks for all the help though!
    – Arvo Bowen
    Jul 6, 2016 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .