I have disabled all "Windows protector" anti virus features, at least as far as Microsoft will admit to me when I use the Action Center tray icon to disable it.

However I still see MsMpEng.exe running, it consumed 100% of my disk bandwidth for 7 minutes at boot time, and even sometimes I see MsMpCmd.exe running on my machine. Is microsoft lying to me? Do they run their tools even when you tell them not to? Is there a secondary way to actually disable this stuff?

Windows Defender service is Enabled in the services panel (services.msc), and Microsoft seems to try to prevent you from disabling it. From an administrator command prompt "sc stop WinDefend" and "net stop WinDefend" return "Access is denied". That's microsoft speak for "this is our computer, piddly human, kindly do not interfere with our use of it".

Update: From my googling, it seems the only known way is to boot to Linux and rename the "c:\Program Files\Windows Defender" folder.

  • I was about to suggest booting a utility disc to see if you can change the settings from there. Linux will do it, but the program may come back during the next update cycle. You may be able to disable the service if you boot into Safe Mode. Fortunately or unfortunately, my W8 system decided to give UEFI errors on any attempt to boot or restore, so I have no system where I can check if my suggestion works. – AFH Mar 17 '15 at 23:34
  • Just install any proper antivirus, it will disable defender for you. – Tetsujin Mar 18 '15 at 8:55

If you could just stop the service, any malware could too, however by unchecking two settings, you can fully disable Defender:

enter image description here

enter image description here

After Save changes the MsMp*.exe processes will be gone and the services stopped.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.