62

I am running Windows 10 on a fairly recent laptop. I'm using Avast (free version) as antivirus and before the update, Windows Defender was turned off as it should be in case a third party antivirus is installed.

Yesterday I received a notification of an available update for the OS. I ran the update on shut down, and this morning when turning the computer on, it completed the updating procedure in about 1 hour.

The update, as far as I can tell, restored a lot of bloatware that was installed on the PC at the time of the purchase, installed some additional Visual Studio components and some new applications, and it turned on Windows Defender.

I find this all weird since Avast was (and still is) running fine as usual, but now I have a resource hog (Windows Defender) sucking on my PC resources. Furthermore Cortana is running in the background even though I disabled it...

Why has this thing happened and how can I turn Windows Defender off? Since apparently it has not detected that Avast is running, it somehow turned itself back on again.

  • 22
    Windows Defenser recieved changes so it can run along side of third-party security. It can still be turned off. You don't have to disable it unless you want to – Ramhound Sep 5 '16 at 4:16
  • 44
    As a sidenote: this happened because this update (Version 1607 "Anniversaty Update") was in fact not an update but an upgrade, which uses a different installation method, the same as when upgrading from an older Windows version. This upgrade process tends to reset a lot of stuff. Also check your privacy settings! – Michael Borgwardt Sep 5 '16 at 8:36
  • 17
    To be fair, Windows Defender is among the LEAST demanding anti-virus on Windows 10. The entire thing, including the UI, and the two services takes up just under 80MB of memory while idle. It also takes less than a second to stop a background scan on user activity, and I tend to never actually notice it doing its thing. This doesn't speak to its efficacy of course, but to say it is a resource hog (compared to Avast of all the bloat-filled AV packages!) is just wrong. – Drunken Code Monkey Sep 6 '16 at 16:45
  • 1
    @MichaelBorgwardt you are right, some privacy settings were reset too.. – mickkk Sep 9 '16 at 21:33
  • 1
    @DrunkenCodeMonkey I disagree with you, maybe it's just on my machine, but it was taking 250MB of memory which I found absurd. Avast or AVG, from my personal experience, tend to run much smoother and use less resources. But then again, I think this update messed something up, so under "normal" circumstances you may well be right. – mickkk Sep 9 '16 at 21:35
21

The safest way to do this is to uninstall Avast! (in Programs and Features) and then to reinstall it. That will ensure that MS hasn't removed any part of the Avast! suite's protection. Reinstalling Avast! will then disable Defender correctly.

Merely shutting Windows Defender does not guarantee that third-party AV will be working properly.

Postscript: As has noted in comments, recent Windows updates reinstall Defender, even though third-party AV has already been installed. There is not much impact, I find, except on cold boot, but scheduled scans can be disabled in Scheduled Tasks. For example, using Nisoft's TaskSchedulerView, right-click on an item and select Disable.

Windows Defender scheduled scan

Also turn off scans and the alert message in the Windows Defender Security Center that Defender.

Insecurity Center alerts

  • So how does he know whether a future automatic update wont break avast? Sounds like another evil schema to kill competition to me :/ – akostadinov Sep 7 '16 at 12:52
  • Correct: MS updates change things at a very low level, so it can do things like disabling AV, destroying a Linux partition (myce.com/news/…), etc. – DrMoishe Pippik Sep 7 '16 at 14:18
  • wow, this thing needs to be touched only inside a heavily firewalled VM and only for the task then shut it off. – akostadinov Sep 7 '16 at 20:20
  • The same can be said for Linux updates, or Mac updates... update mechanisms have the power to do anything to the OS, including installing a different OS. – DrMoishe Pippik Sep 8 '16 at 13:53
  • dunno about macs, but obviously you have not maintained linux. Linux plays well with others. Sure updates can do everything. But in 10-15 years I've not seen an update to linux that breaks any other OS installed on same disk. While major windows updates have regularly done so. And this is evil. – akostadinov Sep 9 '16 at 18:38
37

Disable Windows Defender with Local Group Policy Settings

To Turn On or Off Windows Defender using Group Policy

  1. Open the Local Group Policy Editor.

  2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

    Computer Configuration/Administrative Templates/Windows Components/Windows Defender

    enter image description here

  3. In the right pane of Windows Defender in Local Group Policy Editor, double click/tap on the Turn off Windows Defender policy to edit it. (see screenshot above)

  4. Do step 5 (on) or step 6 (off) below for what you would like to do.

  5. To Turn On Windows Defender

    A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

    NOTE: Not Configured is the default setting.

  6. To Turn Off Windows Defender

    A) Select (dot) Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

    enter image description here

  7. When finished, you can close the Local Group Policy Editor if you like.

  8. If you are turning on Windows Defender, then open Windows Defender, and click/tap on Start now if needed. (screenshot below)

source

Restart the Computer afterwards to confirm and ensure everything becomes effective.

17

Disable Windows Defender with Local Registry Settings

If you're not able to use Group Policy then see To Turn On or Off Windows Defender using a REG file.

WARNING: Before working in the Windows Registry, it is always a good idea to back it up first, so that you have the option of restoration, should something go wrong. This article shows the different ways to back up and restore the Windows Registry or its Hives.

To Turn On or Off Windows Defender using a REG file

The .reg files below will add and modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

DisableAntiSpyware DWORD

(delete) = On
1 = Off

To hide Windows Defender notification icon: (when turned off)

Code:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]
"Windows Defender"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsDefender"=-

To show Windows Defender notification icon: (when turned on)

Code:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run]
"WindowsDefender"=hex:06,00,00,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsDefender"=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
  46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\
  00,73,00,20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,4d,00,\
  53,00,41,00,53,00,43,00,75,00,69,00,4c,00,2e,00,65,00,78,00,65,00,22,00,00,\
  00

  1. Do step 2 (on) or step 3 (off) below for what you would like to do.

  2. To Turn On Windows Defender

    NOTE: This is the default setting.

    A) Click/tap on the Download button below to download the file below, and go to step 4 below.

    Turn_On_Windows_Defender.reg: Download

  3. To Turn Off Windows Defender

    A) Click/tap on the Download button below to download the file below, and go to step 4 below.

    Turn_Off_Windows_Defender.reg: Download

  4. Save the .reg file to your desktop.

  5. Double click/tap on the downloaded .reg file to merge it.

  6. If prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

  7. If you are turning off Windows Defender, sign out and sign in to apply.

  8. If you are turning on Windows Defender, then open Windows Defender to apply.

  9. If you like, you can now delete the downloaded .reg file.

source

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.