Skip to content

Tags: SysAdminDoc/DisableDefender

Tags

v0.0.4

Toggle v0.0.4's commit message
Initial release v0.0.4

Microsoft Defender Antivirus disabler / remover for Windows 10/11
with firewall preservation. CLI + premium WPF GUI.

- Three modes: Disable (reversible), Remove (aggressive), Restore (undo)
- Critical firewall services (mpssvc, BFE) and per-profile state verified
  pre and post every operation; abort on integrity break
- Registry ACL takeover via SeTakeOwnershipPrivilege + Microsoft.Win32.Registry
  as primary service-key edit path; SYSTEM-via-transient-task fallback
- Full policy coverage: DisableAntiSpyware, real-time, behavior, IOAV, IPS,
  IPC, Spynet, MAPS, NIS, IPS-throttle, MpEngine PUA + file-hash, signatures,
  scan, SmartScreen, MRT, passive-mode for MDE, UX suppression
- 17 Defender services targeted incl. MDCoreSvc, MDDlpSvc, MsSecFlt/Core,
  SgrmAgent/Broker, webthreatdefsvc
- SecHealthUI deprovision via DISM NonRemovableAppPolicy override
- SafeBoot\WinDefend trap (Remove mode) prevents resurrection in Safe Mode
- System Restore checkpoint before destructive ops
- Premium WPF GUI: Catppuccin Mocha, custom chrome, 6 live status tiles,
  async worker runspace, streaming log pane, toast notifications,
  confirmation modal, Tamper Protection banner