This should NOT be happening as far as I am concerned:
There are times I need to turn off the built-in Antivirus (Defender) in Windows 10. I turn it off and make sure is is off right then.
Thirty minutes to an hour later I go back to it and it is back ON. IS there some kind of timer on when I turn the antivirus off?
I need to be able to turn it off and be assured that it stays off until I turn it back on manually.
How do I do that
MS is trying to prevent just that, you can not even use Autoruns for it anymore.Code:reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
Try to disable defender's services in safe mode. I use those to turn it OFF/ON:
Windows/Microsoft Defender Disable.bat at main . TairikuOokami/Windows . GitHub
Windows/Microsoft Defender Enable.bat at main . TairikuOokami/Windows . GitHub
Yeah there is a timer, on 1809 because I couldnt disable tamper protection I added a task that monitors for event code that is logged when defender is turned on, so when its auto turned on, I then auto turn it off after.
In newer builds you can disable tamper protection and add group policy to keep it disabled. There is also defender control which emulates having 3rd party AV installed.
The group policy method has the advantage though you can keep certain parts of defender enabled if you wanted to.
Just curious: how long has this issue existed and how long has Microsoft been working to fix this issue? Reason I asked is that I have two PCs with Windows 10. There are minor differences in the two, so I am guessing they are different versions. I still think Win 7 was the best OS Microsoft ever put out. I still run every day a PC with Windows 7. Yes I know it is long in the tooth, but it still gives me less problems than Windows 10 or 11.
Just some background for me. I may have ruined about 50 pieces of software that I have spent months collecting. Some of them had minor issues that Windows considered viruses. I am not sure they will install without those issues.
BTW I went into safe mode and tried to disable Defender. Everything in the Management part of Defender was greyed out so, NO luck there.
Does anyone know how long the timer runs before turning Defender back ON?
- - - Updated - - -
I was doing some more reading on this subject and ran across this statement: If you just want to exclude a single file or folder from antivirus scanning you can do that by adding an exclusion.
For me it would be nice just to exclude a single drive (1 TB drive has 3 partitions). I am not sure this is even possible.
Any more information on this would be appreciated.
Thanks
I'm on Windows 11 at the moment but it should be the same on 10.
In Defender select Virus & threat protection -Virus & threat protection settings - Manage settings and in the new page scroll down to Exclusions. Select -Add or remove exclusions, accept the UAC prompt, and in the new page that opens select Add an exclusion. In the dropdown menu select 'Folder' and in the select folder popup select any partition on the left.
You can even select the C: partition
Not sure on the current timer period, I think I remember it used to be 24 hours, however whenever a definition database is downloaded, that will also turn it back on.
A reboot will also turn it on.
Hence using group policy or some kind of automation to detect when its turned on is what is likely to be less frustrating.
By design the off widget in settings, is temporary.
There's a tutorial all about it.
Add or Remove Windows Defender Exclusions - TenForumsTutorials
Denis
Quote
