0

I turned off all Windows Defender settings on my Windows 10 VM, but real-time protection kept re-enabling itself. I then found a registry setting to turn it off for good, but now Windows Defender Antivirus Service consumes tons of memory (>3GB).

I reverted the change, but it's still taking tons of memory (>800MB). I think the drop is related to reverting the registry change, and re-enabling real-time protection, but it would be great to actually turn it off.

enter image description here

MStodd
  • 109
  • 3

2 Answers2

2

I'm not aware of the setting which is to be done through regedit, but I can comment about disabling it using the Group Policy.

Please follow the steps in the order as listed below:

  1. Go to "Run". Type "gpedit.msc" and press Enter. A window titled "Local Group Policy Editor" will launch.

  2. Go to Computer Configuration on the left pane, and then double click on "Administrative Templates".

  3. Once Administrative Templates gets expanded, then go to "Windows Components" and double-click/expand the item.

  4. Inside Windows Components, go to "Windows Defender Antivirus" and double-click the folder.

  5. Once expanded, the settings for the Windows Defender Antivirus will be visible on the right-side as shown below.

enter image description here

  1. Next, you can launch the "Turn off Windows Defender Antivirus" option -> click on "Enabled" -> Click on "Allow" -> Click on "OK".

enter image description here

-> Voila, that's it. Your Windows Defender Antivirus should stop working as described in the image and listed below.

If you enable this policy setting, Windows Defender Antivirus does not run, and computers are not scanned for malware or other potentially unwanted software.

NOTE: Please note that if you've a group policy in effect which is controlling this Setting, then it'll restore the default settings, OR may not allow you to make any changes. You may need to confirm the same from the System-Administration team, or whoever looks after the ADS, if that be the case.

Am_I_Helpful
  • 424
1

Run regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender, create a DWORD DisableAntiSpyware and set it to 1:

enter image description here

After reboot, Defender is fully off.

Attention: DisableAntiSpyware is ignored for Windows 10 (1903 and newer versions) since August 2020:

DisableAntiSpyware is intended to be used by OEMs and IT Pros to disable Microsoft Defender Antivirus and deploy another antivirus product during deployment. This is a legacy setting that is no longer necessary as Microsoft Defender antivirus automatically turns itself off when it detects another antivirus program. This setting is not intended for consumer devices, and we’ve decided to remove this registry key. This change is included with Microsoft Defender Antimalware platform versions 4.18.2007.8 and higher KB 4052623. Enterprise E3 and E5 editions will be released at a future date. Note that this setting is protected by tamper protection. Tamper protection is available in all Home and Pro editions of Windows 10 version 1903 and higher and is enabled by default. The impact of the DisableAntiSpyware removal is limited to Windows 10 versions prior to 1903 using Microsoft Defender Antivirus.

magicandre1981
  • 99,606