Most high PageRank(tm)ing articles regarding Antimalware Service Executable gobbling your precious CPU cycles encourage you not to try to disable Microsoft Defender Antivirus (née Windows Defender) at all - the suite responsible for this process. That's excellent advice for common folk but you're an evil genius that insists your underpowered Atom subnotebook or your sorely overallocated Windows virtual machines are usable at the expense of the debatable protection this resource hog affords. Realtime antivirus protection is after all best suited for reckless random program-downloading drunks and freeware card game addicted grandmothers. You have the self control to only run trusted software, install only programs you set out to download and if you must test a shady .MSI-of-the-night you have the good sense to do it in a disposable VM.
As the Settings > Windows Security > Virus & threat protection settings > Manage settings > Real-time proection toggle correctly admonished you before you came looking for this: You can turn off this setting for a short time before it turns back on automatically. It's nice that Windows respects you as the owner of your own computer. Don't take this crap laying down! You always have options.
- Install a more efficient alternative Antivirus Provider
Probably your safest option but not why you picked this search result.
- First Step: Disable Tamper Prevention
Most of the following methods require you to first disable this security feature.
- Optional: Run as TrustedInstaller
There's no telling what permissions problems we're going to run into and they can change from Windows Update to Update. Let's preempt the bother and take control of the system.
- Windows Home: Registry Edit
The registry edit method worked for me on a fully updated installation of Windows 10 at the time of publishing but there are circumstances where it might be ignored.
- Windows Home: Autoruns64
There is a GUI utility that might be the answer for you.
- All Other Versions: Group Policy Editor (gpedit.msc)
The generally accepted method for politely and permanently disabling Defender is to use the Group Policy Editor found on Pro/Ultimate/etc. distributions but unfairly missing from unmodified Home installations.
- Windows Home: Installing Group Policy Editor (gpedit.msc)
Microsoft wants you to pay for a few bits of code they already made which you can find laying around everywhere. Pinch it like a tea leaf; I won't tell if you won't tell! :)
- All Versions: LiveCD Filesystem Assault
When all else fails we can just march on in and fsck its junk right up!
1. Installing an alternative Antivirus Provider
When a compatible third party antivirus/antimalware engine is detected to be running Defender will automatically deactivate. The idea here is if we can install an engine that is more modular and provides finer control over configuration we can engineer a situation that still provides some protection from malware but takes up less resources than Defender. A conventional blog post on malware defense would encourage you to configure Defender to scan alongside your alternative engine; I will take this opportunity to suggest that you go back to your Manage providers settings later and double check that Defender's Periodic Scanning option is still disabled (default) after installing your favourite third party scanner.
I'm not paid to recommend MalwareBytes (https://www.malwarebytes.com/) but I'm comfortable pushing it on you because of its long benevolent track record and consensus warm feelings from the security and privacy conscious. That being said I have not performed any benchmarks - neither casual nor diligent - that could give me any legitimate footing to claim this configuration is better than Defender alone. Consider it an exercise in exploring all the options; if security absolutely takes a back seat to performance in your situation feel free to skip ahead.
Be prepared to skip installing the optional free browser protection add-on as you sprint through the installer, on the assumption our main objective here is resource reclamation. Post-install you will be badgered to buy and forced to try Premium - which contains all the resource wrangling features you never wanted. Apologies in advance for the minor aggravation to be visited upon you at trial's end two weeks hence. Don't forget to use creative swearing in the following slide's Email field to show your appreciation for the inability to opt-out in advance.
While I think a monthly-or-so manual malware scan is good juju, even on machines you know you practice ninja-level browser hygiene with (browser 0dh3y, PDF links, psychopathic boyfriends' USB sticks, minor miracles - even herpes - sometimes happen to the very best of us) that's now your problem to forget. We're here to lock this crap down. Under the Real-Time Protection UI card un-toggle every option including but, if different, not limited to:
- Web Protection
- Ransomware Protection
- Exploit Protection
You MUST leave Malware Protection enabled or Windows will not recognise a running AV engine and will not hand over the reigns from Defender.
By default a daily scan is configured to start tomorrow. Click the date in the Scanner UI card and either delete the scheduled task or modify it to suit your needs. If you choose to configure automated scanning you should probably leave automatic updates enabled in the following steps. Don't forget to click Advanced and check Scan for rootkits - I can not fathom why that's not enabled by default.
Now click the gear icon to open settings. Going through each tab, disable or change each option accordingly (again, use your judgement if the options have changed in the intervening time since this was published):
- Automatically download and install updates (but don't forget to manually check for updates before every manual scan! leave enabled if you can't trust yourself or if you want your Realtime Protection to be as effective as possible. You're stuck with that much anyway, choose your preference accordingly.)
- Notify me when a new version becomes available
- Add Malwarebytes options to Windows Explorer (unless you'd like the option to quickly scan individual files from the Explorer shell; the performance hit from including the context menu items is in truth likely marginal. but we're serious about optimization right?! RACING STRIPES!! HARDCORE!!! \m/)
- Change Manual scan performance impact to take less priority in case you end up needing to use the machine after starting a manual scan. one can not predict the future after all.
- Usage and threat statistics - I have no evidence this will help but it could cut down some daemon's background chatter and what do they need to see your dirty files for anyway?
- Alert me if any Real-Time Protection modules are turned off. *I* turned them off, I don't want to hear it whining!
- Update threat intelligence
- Windows startup
- Advanced
- Enable Self-protection module - I'm only mentioning this item because I think you should leave it enabled. The gains from disabling it can not outweigh its benefits.
- Exploit Protection - This is another decision that warrants consideration.
- !!!IMPORTANT!!! Change the Theme to Dark. Because you're a badass. Obviously.
-
2. Disable Tamper Prevention
Though I have only personally dealt with Tamper Prevention in single-device, single-user Windows 10 environments it can be managed a few different ways. The feature appears on Windows 11; Server v. 1803+; Server 2012 R2, 2016, 2019, and 2022. Therefore I shall at first defer to the official documentation:
...and proceed to plagiarize those portions I think you'll find useful:
Tamper Protection in Windows Security helps prevent malicious apps from changing important Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection. If Tamper Protection is turned on and you're an administrator on your computer, you can still change these settings in the Windows Security app. However, other apps can't change these settings.
Tamper Protection doesn't affect how third-party antivirus apps work or how they register with Windows Security.
Tamper Protection is turned on by default. If you turn off Tamper Protection, you will see a yellow warning in the Windows Security app under Virus & threat protection.
Change the Tamper Protection setting on an individual device
- In the search box on the taskbar or after opening the windows menu, type Windows Security and then select Windows Security in the list of results.
- In Windows Security, select Virus & threat protection and then under Virus & threat protection settings, select Manage settings.
- Change the Tamper Protection setting to Off.
For instructions on managing Tamper Protection in multi-device environments, i.e. where Microsoft Endpoint Manager or Intune are being used to manage configurations across up to hundreds or thousands of devices and/or virtual machines in an organization or cloud automatically please see the Microsoft 365 Defender documentation to determine the best way to deploy your configuration changes with respect to your product ecosystem.
Use PowerShell to determine whether tamper protection and real-time protection are turned on
- Open the Windows PowerShell app.
- Use the
Get-MpComputerStatus PowerShell cmdlet.
- In the list of results, look for
IsTamperProtected or RealTimeProtectionEnabled. (A value of true means tamper protection is enabled.)
In my experience, after implementing some of the following methods to disable Defender you will lose access to the Tamper Protection setting via the Windows Settings GUI unless and until you revert the modification. It's also possible to activate and deactivate Tamper Protection via the registry - but to do that we're going to need the big guns...
3. Run as TrustedInstaller
You may have a stronger constitution than me but the record of blog posts that Google has accumulated over the past two years regarding disabling Defender leaves my head spinning. It seems to be a story of constant changes in abilities, permissions and values. What works one month can't be relied on to work the next. Changes are announced, implemented, reverted in silence then phased back out again. Accordingly I should take this moment to be clear with you: by the time you read this page some of the instructions may not work. Registry keys might be deleted, renamed or removed altogether. Inherently esoteric DWORD values could change meaning without any notice. So if something isn't working for you please don't get frustrated or spend too much time fiddling on the assumption that you might have made a mistake - I recommend you go straight to Google and look up keywords relevant to whatever you're trying and visually filter for the most recently posted articles. A lot of initial confusion seems to have come from the simple fact that certain keys have different effects depending on special circumstances and until enough people have discovered and documented them false assumptions are all the easier to make and perpetuate.
Taking ownership of registry keys is messy and opening up permissions then walking away is poor form. Forget the registry - there are a lot of things we can do from the CLI I'd like to make note of but to keep track of and test what permissions are currently required to do what would be a waste of time when we can just escalate all the way to the top of the food chain and bulldoze onward.
There are a number of great tools that will let you start processes as any user you want but for our purposes these are my two favourite:
Process Hacker
Process Hacker is full of awesome functionality
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
RunAsTrustedInstaller
