12

I am searching for a command to temporarily turn off Windows Defender.

Any suggestions?

1
11

Using PowerShell (as an administrator) in Windows 10, use the following command:

Set-MpPreference -DisableRealtimeMonitoring $true

To re-enable it:

Set-MpPreference -DisableRealtimeMonitoring $false

Source

9
  • Readers should note that one must be running powershell "as administrator" for that to work. Similarly, for the sc commands in the other answers here, one must be running the command line as admin for those to work. While Powershell's error makes that clear, at the command line, one would just get "Access is denied", which is not at all obvious. Jun 5 '18 at 14:20
  • 2
    I don't think this method work anymore for 1903...
    – navossoc
    Jul 12 '19 at 3:17
  • @navossoc Confirmed, ps command is still available but does not work on 1903, hmmmm.
    – Moab
    Jul 13 '19 at 16:46
  • @Moab Yeah, the last time I used this command was in version 1803 and I'm sure it worked. The 1809 version I skipped, so I can not tell for sure if it started in 1809 or 1903.
    – navossoc
    Jul 14 '19 at 17:28
  • @Moab just for the sake of completeness, the command works on 1809 too...
    – navossoc
    Jul 17 '19 at 22:29
10

I am searching for a command to turn off Windows Defender

You can use sc (Service Control) to stop and start Windows Defender:

sc stop WinDefend

And:

sc start WinDefend

Example output:

F:\test>sc stop WinDefend

SERVICE_NAME: WinDefend
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

F:\test>sc query WinDefend

SERVICE_NAME: WinDefend
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

F:\test>sc start WinDefend

SERVICE_NAME: WinDefend
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 6304
        FLAGS              :

F:\test>sc query WinDefend

SERVICE_NAME: WinDefend
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Further Reading

7
  • 5
    OpenService FAILED 5: Access Denied. (In Admin CMD)
    – darkore0
    Feb 28 '16 at 23:07
  • @darkore0 Running which command? What is the output from sc query WinDefend?
    – DavidPostill
    Feb 29 '16 at 8:43
  • Same here. couldn't stop it.
    – alpha_989
    Apr 16 '18 at 0:43
  • 1
    It could be stopped/started by the commands via PowerRun v1.3 (sordum.org/9416). Nov 26 '18 at 12:10
  • 1
    Running as admin and still got Access is denied error.
    – Salman A
    Feb 27 '19 at 10:51
4

To disable:

sc config WinDefend start= disabled
sc stop WinDefend

To re-enable:

sc config WinDefend start= auto
sc start WinDefend

Don't forget about the space after "start=" or the command will not work.

PS. You can get further description of these commands by typing:

sc /?
sc config /?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.