How to Turn On or Off Microsoft Defender Antivirus in Windows 10  

rseiler said:

It seems that the new 1903 feature called "Tamper Protection" was running interference. Disable that, and I think you'll find that the policy works as expected.

When MS said that Tamper Protection "prevents others (including malicious apps) from changing important protection features," they apparently were including their own controls (i.e. policy).

Good catch. I can confirm this as well. Tutorial updated to include this now.

Tamper protection can be disabled via registry, that is not very tamper-free.
Basically, it is possible to completely disable WD and its services via reg/bat.

Code:

reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f

TairikuOkami said:

Tamper protection can be disabled via registry, that is not very tamper-free.
Basically, it is possible to completely disable WD and its services via reg/bat.

Code:

reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f

You would need to take ownership of the key and set permissions first to be able to change the DWORD value.

Brink said:

You would need to take ownership of the key and set permissions first to be able to change the DWORD value.

I did a clean install and disabled it without doing anything, but I can not edit it now, maybe an update fixed it.

TairikuOkami said:

I did a clean install and disabled it without doing anything, but I can not edit it now, maybe an update fixed it.

Interesting. An update could reset the owner and permissions back to default.

Steve C said:

I tried to run the command MpCmdRun -ValidateMapsConnection in an admin command window which failed. It did run when I pointed the command prompt to directory C:\Program Files\Windows Defender.

I that normal behaviour since I thought MpCmdRun would just execute?

Hello Steve,

Yeah, it's normal. An elevated command prompt uses the "C:\Windows\System32" path by default, so a command at any other path will have to specified.

These methods no longer work in Enterprise LTSC (1809). I can't even get a Security Center working.