7

So, I need to automatically disable Windows Defender for certain virtual machines via a PowerShell script. Previous to the May update, one could set the DisableAntiSpyware and DisableRoutinelyTakingAction in the registry and Defender was disabled.

Now with version 1903, this doesn't seem to work anymore. Even with disabling the Anti temper protection via registry and rebooting, I only get a permission denied when trying to set the two registry values.

Does anyone have ideas how I could solve this? I tried using the Invoke-CommandAs to do this as SYSTEM, however this didn't work either sadly.

4
  • Please provide some details on the properties of those two keys. You might want to try adding the user who runs the script to the list of users with read/write access.
    – Ramhound
    Jun 12, 2019 at 17:29
  • So, are you saying, you want no AV on those hosts? Historically, if so, MP gets disabled when you install another AV solution.
    – postanote
    Jun 13, 2019 at 5:25
  • The two keys disable the on-demand scanner and Windows Defender automatically taking action if it detects anything (e.g. scheduled scan). Yes, I want no AV on these hosts. They're just virtual machines for security research, so an AV on those would be pretty annoying.
    – Nirusu
    Jun 13, 2019 at 7:52
  • The typical answer to OP's question would be to use Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableRealtimeMonitoring $false However, it seems that since 1903 update (the Windows version which OP is asking about), Microsoft has disabled this ability - and there seems to be a complete lack of information about it online right now. Jun 24, 2019 at 19:52

1 Answer 1

6

Okay, I guess I found a way.

Either use Defender Control or elevate a PowerShell session TrustedInstall (SYSTEM is not enough!), stop and disable the service and afterwards create the registry key. For elevation, I used the seperate tool RunAsTi.

This is what I used:

Stop-Service WinDefend
Set-Service WinDefend -StartupType Disabled
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name "DisableRoutinelyTakingAction" -Value 1

Now, this works so far. However, I still need to automate it that it works completely standalone, e.g. I have to develop the elevation part in PowerShell.

3
  • 1
    is there any way to run PS as TrustedInstall w/o any 3rd party tools? Aug 19, 2019 at 19:48
  • 1
    It's not quite w/o 3rd party tools, but you can use the NTObjectManager in combination with its New-Win32Process to spawn a PS instance as a child from trustedinstaller.exe. Internally, I have used this as a solution: Install the NtObjectManager module, start the TrustedInstaller service, use New-Win32Process and run powershell with the above commands encoded.
    – Nirusu
    Sep 3, 2019 at 8:00
  • 1
    UPD: RunAsTi seems not working anymore. Can't catch crash log because it spawns in new cmd instance and instantly disappears. I found NSudo working nice. github.com/M2Team/NSudo Oct 1, 2019 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .