Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defender disable script not working in Windows 11 #296

Open
TechieAndroid opened this issue Oct 2, 2021 · 8 comments
Open

Defender disable script not working in Windows 11 #296

TechieAndroid opened this issue Oct 2, 2021 · 8 comments

Comments

@TechieAndroid
Copy link

This is what happens in my Powershell admin terminal:

PS C:\Users\youbr\Downloads\Debloat-Windows-10-master\scripts> ./disable-windows-defender.ps1
Elevating priviledges for this process
Trying to disable scheduled task Windows Defender Cache Maintenance

TaskPath                                       TaskName                          State
--------                                       --------                          -----
\Microsoft\Windows\Windows Defender\           Windows Defender Cache Mainten... Disabled
Trying to disable scheduled task Windows Defender Cleanup
\Microsoft\Windows\Windows Defender\           Windows Defender Cleanup          Disabled
Trying to disable scheduled task Windows Defender Scheduled Scan
\Microsoft\Windows\Windows Defender\           Windows Defender Scheduled Scan   Disabled
Trying to disable scheduled task Windows Defender Verification
\Microsoft\Windows\Windows Defender\           Windows Defender Verification     Disabled
Disabling Windows Defender via Group Policies
Disabling Windows Defender Services
Exception calling "SetAccessControl" with "1" argument(s): "Attempted to perform an unauthorized operation."
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\lib\take-own.psm1:26 char:5
+     $key.SetAccessControl($acl)
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : UnauthorizedAccessException

Exception calling "SetAccessControl" with "1" argument(s): "Attempted to perform an unauthorized operation."
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\lib\take-own.psm1:32 char:5
+     $key.SetAccessControl($acl)
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : UnauthorizedAccessException

Set-ItemProperty : Attempted to perform an unauthorized operation.
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1:37 char:1
+ Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDe ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (Start:String) [Set-ItemProperty], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetItemPropertyCommand

Set-ItemProperty : Attempted to perform an unauthorized operation.
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1:38 char:1
+ Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WinDe ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (AutorunsDisabled:String) [Set-ItemProperty], UnauthorizedAccessExcept
   ion
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetItemPropertyCommand

Set-ItemProperty : Attempted to perform an unauthorized operation.
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1:39 char:1
+ Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNis ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (Start:String) [Set-ItemProperty], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetItemPropertyCommand

Set-ItemProperty : Attempted to perform an unauthorized operation.
At C:\Users\youbr\Downloads\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1:40 char:1
+ Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WdNis ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (AutorunsDisabled:String) [Set-ItemProperty], UnauthorizedAccessExcept
   ion
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetItemPropertyCommand

Removing Windows Defender context menu item
Removing Windows Defender GUI / tray from autorun
@W4RH4WK
Copy link
Owner

W4RH4WK commented Oct 4, 2021

Windows 11 is not supported.

@TechieAndroid
Copy link
Author

Windows 11 is not supported.

Oh okay I wasn't aware that it was version dependant. Just out of curiosity, what makes Windows 11 specifically incompatible?

@W4RH4WK
Copy link
Owner

W4RH4WK commented Oct 4, 2021

It's not that Windows 11 is completely incompatible. It's just that I've not tested any of the scripts on Windows 11 and currently lack the time and motivation to debug and fix issues.

They might just work for the most part, or they might not. Personally, I'll stick with Windows 10 for a while, and will probably switch back to Linux when I put together a new rig.

@TechieAndroid
Copy link
Author

It's not that Windows 11 is completely incompatible. It's just that I've not tested any of the scripts on Windows 11 and currently lack the time and motivation to debug and fix issues.

They might just work for the most part, or they might not. Personally, I'll stick with Windows 10 for a while, and will probably switch back to Linux when I put together a new rig.

I understand. Yeah I mostly use Linux myself but my job required me to get back into using Windows regularly, so I have been digging into the internals and trying to find ways to lessen the memory usage in it.

I tried disabling defender throu group policy and the registry but neither worked, it keeps coming back. My final resort was going to be wiping the program files for defender from windows. I've done it before but I never much cared for destructive methods.

@W4RH4WK
Copy link
Owner

W4RH4WK commented Oct 5, 2021

I tried disabling defender throu group policy and the registry but neither worked, it keeps coming back. My final resort was going to be wiping the program files for defender from windows. I've done it before but I never much cared for destructive methods.

Disabling Defender's real-time protection via group policies and disabling Scheduled Tasks was enough for me such that it doesn't cause any issues. Ripping out Defender completely causes issues with other components like the Windows Store.

@TechieAndroid
Copy link
Author

I tried disabling defender throu group policy and the registry but neither worked, it keeps coming back. My final resort was going to be wiping the program files for defender from windows. I've done it before but I never much cared for destructive methods.

Disabling Defender's real-time protection via group policies and disabling Scheduled Tasks was enough for me such that it doesn't cause any issues. Ripping out Defender completely causes issues with other components like the Windows Store.

Does the anti-malware service still run for you?
That's what I was trying to disable.

@W4RH4WK
Copy link
Owner

W4RH4WK commented Oct 5, 2021

No, I think disabling the Scheduled Task took care of that.
image

@kokotas89
Copy link

kokotas89 commented Mar 15, 2022

Untitled

No, I think disabling the Scheduled Task took care of that. !

Hello W4RHAWK! I have been following your advice to disable Defender on a fresh win10 installation via group-policy for a few months, but it seems something re-enables the tasks every month or so and a quick is scan is performed regardless.

The only policy I enabled was "Turn-off real time protection". Have you noticed anything of the sort or have any insights on what could be resetting the tasks?

TIA

Edit: Maybe forced catch-up scans are the culprit here? I will try disabling them but I still don't see why this would set the status of the schedules scans back to Enabled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants