To disable the Defender run regedit.exe
, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
, take ownership of this registry key (inside regedit.exe (still applies to Windows 10) or via the 3rd party tool RegOwnershipEx) and set the values DisableAntiSpyware
and DisableAntiVirus
both to 1
.
click to enlarge
Note, if you only see 1 of the values, change this one.
In newer Windows 10 Versions (1703, 1709, 1803) you need to go key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
, create a DWORD DisableAntiSpyware
and set it to 1
:
Attention:
DisableAntiSpyware is ignored for Windows 10 (1903 and newer versions) since August 2020:
DisableAntiSpyware is intended to be used by OEMs and IT Pros to
disable Microsoft Defender Antivirus and deploy another antivirus
product during deployment. This is a legacy setting that is no longer
necessary as Microsoft Defender antivirus automatically turns itself
off when it detects another antivirus program. This setting is not
intended for consumer devices, and we’ve decided to remove this
registry key. This change is included with Microsoft Defender
Antimalware platform versions 4.18.2007.8 and higher KB 4052623.
Enterprise E3 and E5 editions will be released at a future date. Note
that this setting is protected by tamper protection. Tamper protection
is available in all Home and Pro editions of Windows 10 version 1903
and higher and is enabled by default. The impact of the
DisableAntiSpyware removal is limited to Windows 10 versions prior to
1903 using Microsoft Defender Antivirus.