80

I can't disable the Microsoft Antimalware service (MsMpSvc/MsMpEng.exe). I tried using services.msc, but the Startup Type drop-down is grayed out and I can't change it to Disabled nor stop the service. I also tried msconfig, but when I click Apply, the service gets enabled again. I even tried net stop msmpsvc and got system error 5 (access denied).

Any suggestions?

Improve this question
11
  • Do you have admin rights on the computer?
    – salih0vicX
    Oct 27, 2012 at 17:19
  • Yes, of course.
    – Italo
    Oct 27, 2012 at 17:45
  • Which operating system?
    – user3463
    Oct 27, 2012 at 21:33
  • 6
    This is by design for most any anti-virus software. If turning it off were that easy, the software could not be effective against malware.
    – Joel Coehoorn
    Feb 4, 2013 at 20:57
  • Install an antivirus application, such as AVG.
    – Andy
    Jun 5, 2015 at 0:17

11 Answers 11

Reset to default
36

Just in case someone will face the same questions on Windows 8/8.1 - there is now build-in option to stop both Windows Defender-related services:

  • Windows Defender Network Inspection Service and
  • Windows Defender Service:

Turn off Windows Defender

Improve this answer
8
  • 2
    Author is using Windows 7 not Windows 8 and your answer only applies to Windows 8.
    – Ramhound
    Apr 26, 2014 at 23:11
  • 2
    It does not help for me (Win 8.1 prof). I disabled real time protection, turned off this app and there is still MsMpEng.exe consuming my CPU and disk. Computer is soo slow...
    – Tomas Kubes
    Oct 28, 2014 at 19:56
  • @qub1n, well, this is kind of strange. It may sounds obvious, but have you tried to reboot your computer and after that check the check box from the image above?
    – Sevenate
    Oct 30, 2014 at 17:01
  • Yes,I disabled it months ago.
    – Tomas Kubes
    Oct 31, 2014 at 7:32
  • 2
    this answer works for Windows 7. I was able to Disable Real-time protection and uncheck the "Turn on this app" option. After clicking past the dire warnings, the icon removed itself from the task bar and the unstoppable Windows service stopped.
    – pdwalker
    Apr 20, 2016 at 18:56
16

Another way to get around the protection:

  1. Go to options and
  2. Find where it says "Exclude files and folders"
  3. Then just add the "C:\" drive.

This way even if you can't disable it outright, it can't scan your computer at all.

Also do this for both Windows Defender and Microsoft Essentials.

Improve this answer
3
  • 1
    Of course, don't forget to remove the exclusions once you're done with whatever you wanted to accomplish, otherwise it's as good as not having it installed at all.
    – Karan
    Jul 14, 2013 at 3:55
  • 5
    Not having it installed at all sounds like exactly the solution to the problem. Anyone going to these lengths SHOULD know that they can't expect their babysitter to keep them from destroying their machine with warez and virusez any longer.
    – mightypile
    Oct 11, 2015 at 17:10
  • 2
    That's not quite true +Karan, not having it installed at would be even better.
    – Jerry Asher
    Aug 1, 2016 at 19:13
9

The best way to disable the Defender is to run regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender, take ownership of this registry key (inside regedit.exe or via the 3rd party tool RegOwnershipEx) and set the values DisableAntiSpyware and DisableAntiVirus both to 1.

enter image description here
click to enlarge

Note, if you only see 1 of the values, change this one.

Improve this answer
8
  • 1
    Appears to work under Windows 10, I think...
    – Andrew
    Dec 12, 2017 at 4:11
  • 6
    @Andrew this question is for Win7,8. For Windows 10, go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender and create the DWORDS here and set them to 1.
    – magicandre1981
    Dec 12, 2017 at 16:33
  • Yes, your answer doesn't change any. Thanks though!
    – Andrew
    Dec 16, 2017 at 4:40
  • 1
    This doesn't seem to work. MsMpEng.exe still runs
    – rollsch
    Oct 12, 2019 at 15:27
  • 3
    @rolls Microsoft changes this from each windows 10 version to force users into their shitty program. I'm tired of updating this all time. Try the reg from this blog
    – magicandre1981
    Oct 13, 2019 at 8:30
9

OK appears the UI has changed, at least with windows 10 "creators update":

Settings app -> "Update & Security" -> Windows Defender -> "Open Windows Defender Security Center" -> "Virus & Threat protection" -> "Virus & Thread Protection settings" (button) -> "Real-time protection" slide the selector button to "off"

Now MsMpEng.exe isn't using 100% cpu and system is faster (though unprotected).

For a disk intensive build my build times went from 8m33s to 1m49s whoa! Also note if you use WSL you can exclude its files from windows defender to get similar speedup. Or any other folders.

Improve this answer
6

If you just want to shut it down temporarily:

1) Open the search bar (right side of screen)

2) Search SETTINGS and type in ADVANCED

3) Select "Advanced startup options"

4) Scroll to the bottom and select "Restart now" (computer will restart and bring you to the Advanced Startup options menu.)

5) Select "Troubleshoot" at the Advanced Startup options menu.

6) Select the "Startup settings" option.

7) Select "Disable early-launch anti-malware protection" (option #8)

8) Select the restart button and you'll be brought to windows.

Do whatever you want to do, and the next time you restart your computer it will be enabled automatically again.

Improve this answer
4

On Windows 7, this MsMpEng.exe service is part of Microsoft Security Essentials (find it under Start > All Programs). You can disable its real-time protection, in the Settings tab:

enter image description here

However, this might not disable the MsMpEng.exe service from running, so you'd probably have to uninstall Microsoft Security Essentials for this matter:

enter image description here

Improve this answer
2
3

Windows Defender/Microsoft Security Essentials is very tightly knit into the operating system in order to provide more security. It's best to disable it through the natural means than trying to cut it out piece by piece.

Go to your control panel, and select the entry for your Microsoft Antivirus. It might be listed as "Windows Defender" depending on your update history. Look in the 'settings' section in the Antivirus GUI for a "disable"

Depending on how updated your Windows Defender/MSE is, and how updated you received the program, these steps may vary, but the general idea is the same: disable it the way they provided you, not by trying to be crafty.

You'll find that many antiviruses will inject modifications into discrete crevasses of your operating system in the name of security.
Good rules of thumb to remember are to

  1. Always install, uninstall, disable, and so on, the way the manufacturer intended. If you fail to do so, and you don't know exactly what you're doing, start over. (e.g. Reinstall, then uninstall)
  2. Search for tools which allow you to clean up after failed operations. For example, Symantec provides the Norton Removal Tool, which will scan for leftovers of a damaged [un]installation and remove them.
Improve this answer
2
  • 4
    Thanks for the advice, but that is not what I asked. I can of course uninstall it, and that's what I've been doing. But installing and uninstalling all the time is not practical. I am really looking for a way of disabling it temporally.
    – Italo
    Oct 30, 2012 at 17:48
  • 2
    @Italo Disabling the antivirus via the GUI is a quicker and equally safe alternative to uninstalling. It's covered in my second paragraph. If you must use services.msc, run it as an administrator and disable the service. Note: If your username is not "Administrator", it means you are an administrator, and you must still open "services" by clicking "Run as Administrator"
    – jsvk
    Oct 30, 2012 at 18:20
3

Here is how to completely disable Windows Defender service on Windows 10 and Windows Server 2019:

Run as trusted installer

  • Click on it, you will get this prompt:

Enter the command to run with Trusted Installer privileges

  • Enter C:\Windows\System32\regedt32.exe and click OK.

This will launch Registry Editor with Trusted Installer privileges. Be extra careful because now you will be able to change or delete ANY registry key which means if you delete or change the wrong one you will hose your system.

  • Open HKLM\SYSTEM\CurrentControlSet\Services\WinDefend registry key.

  • Change the Start value to 4.

  • Reboot.

  • Enjoy your PC without Microsoft's protection.

A word of warning, don't do this unless you are absolutely sure you know what you are doing, because it will leave you exposed to malware.

Improve this answer
2
  • This did not worked for me as is (Windows 10 20H2, Build 19042.1415), the service start mode was being reset to Automatic after a restart; it helped me thought because I was able to deny write access to SYSTEM on that WinDefend key, that did the trick so Windows wasn't able to reset my changes after the restart.
    – yv989c
    Jan 24, 2022 at 3:02
  • @yv989c Service start mode should not be auto-resetting after reboot. Preventing write access to that key may break your Windows Update in case the update needs to write anything to that key.
    – Igor Levicki
    Feb 1, 2022 at 13:24
0

Most answers are about Windows Defender, but the questions asks about Microsoft Antimalware Service aka MsMpEng.exe, which is different.

To stop the Microsoft Antimalware Service you need TrustedInstaller permissions. One way to gain those is using the RunAsTI tool. When you run that it opens a command prompt with TrustedInstaller privileges, from which you can stop it with net stop:

C:\>whoami
nt authority\system

C:\>net stop msmpsvc
.
The Microsoft Antimalware Service service was stopped successfully.

Obviously only do this if you know what you're doing and choose to trust the RunAsTI tool (or Process Hacker plugin or whatever you use to obtain TI access).

If you want to disable the service permanently, you can run SubInACL /service MsMpSvc /grant=Administrators=F from that TrustedInstaller command prompt to grant Administrators Full Control over the service, then stop and disable it in the Service MMC snap-in as usual. Note that if you ever start it again it will reset its own permissions, so TrustedInstaller privileges will be required again to stop it.

I've tested this on Windows 7, but it should work on other versions that have TrustedInstaller (Vista and later).

(This is similar to Igor Levicki's answer, but a command-line version. The Process Hacker plugin binary doesn't seem to be available anymore.)

Improve this answer
-1

Go to Settings, Security, Virus & threat protection, Manage settings, Tamper protection. Set to Off. Then add this:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableRealtimeMonitoring"=dword:00000001
Improve this answer
-1

I'm not sure if any of these methods work for anyone, and there is probably a better way (and I'm not sure how permanent this is either), but for me I did the following:

Located the executable for Windows Defender, using open file location in Task Manager. For me it was located at C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0 and was called MsMpEng.exe

Booted up a linux system via usb and used it to deleted the file (since the program was always running, I couldn't delete it while windows was running).

Steps using arch (assuming you have the iso, used rufus to extract onto a usb, and have booted into arch):

fdisk -l and located the name of the partition that would the C: drive (for me /dev/sda3)

mount the drive so that it can be accessed mount /dev/sda3 /mnt/c

used cd to navigate to the exe location. /mnt/c, cd /ProgramData/Microsoft/Windows Defender/Platform/4.18.2107.4-0 used ls to check it was there (you can also do it one dictionary at a time for convenience).

Deleted the file rm MsMpEng.exe

Navigated out of the /mnt filesystem with cd ../

Unmounted the disk with umount

Rebooted and the program was gone.

If nothing works for you. This might at least be a temporary solution :D

P.S. For most people I don't recommend

  1. turning off your antivirus. It's a good way to get malware on your system,

  2. tamper with windows systems in this way, at least without some sort of backup. This is a really good way to completely break your system

Improve this answer
3
  • Deleting files will break Windows Update -- it uses delta patching and expects original files to be present.
    – Igor Levicki
    Jan 17, 2023 at 14:21
  • @IgorLevicki Ah yeah, I found that out later. I'll still use this here, as I do use this from time to time, and it might help someone else
    – Xantium
    Jan 24, 2023 at 13:42
  • IMO, the safest way to remove Windows Defender is to install Windows Server 2022 -- it has an option to remove Windows Defender (remove roles and features).
    – Igor Levicki
    Jan 24, 2023 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .