A professional PowerShell WPF utility to comprehensively disable or re-enable Microsoft Defender on Windows 10/11. Dark-themed GUI with fully async operations, detailed logging, and complete reversibility.
Sometimes you need Defender completely out of the way — deploying custom imaging software, running legacy tools that trigger false positives, benchmarking without AV overhead, or configuring kiosk systems. The built-in Windows UI only lets you temporarily disable real-time protection, and it re-enables itself within minutes.
Defender Control performs a thorough multi-phase disable that persists across reboots by targeting preferences, group policy registry keys, services, scheduled tasks, PPL flags, and more. Everything is fully reversible with a single click.
Windows Firewall is completely untouched. This tool only manages Defender antivirus components. Starting in v3.2.0, this guarantee is machine-checked: every Disable/Enable run snapshots Get-NetFirewallProfile and the mpssvc/BFE service state before the first change and verifies it after the last change. Any divergence is logged as an error.
- 10-Phase Disable — Preferences, group policy, notifications, scheduled tasks, services, PPL flags, context menus, SmartScreen, and process termination
- 7-Phase Enable — Full restoration to Windows defaults with signature update and verification
- Fully Async GUI — All operations run in background runspaces; the window never freezes
- 4-Level Permission Escalation — Direct write → .NET handle with ownership → reg.exe → SYSTEM scheduled task
- PPL Flag Stripping — Removes Protected Process Light from Defender services so they don't survive reboot
- System Restore Point — Automatically created before disabling for easy rollback
- Dry Run Mode — Simulate the entire operation without making any changes
- Verbose Toggle — Filter log output between important-only and full diagnostic detail
- Export Log — Save the full operation log to a text file for troubleshooting or documentation
- Reboot Button — Appears after operations that need a restart
- OS Build Awareness — Detects Win10/11, warns on deprecated GP keys (Win11 22H2+), blocks unsupported versions
- Self-Elevation — Automatically requests Administrator via UAC
- Orphan Cleanup — Removes leftover scheduled tasks from interrupted previous runs
- Firewall Integrity Guard — Snapshots firewall profile state + mpssvc/BFE service state before Phase 1; verifies no divergence after Phase 10
- Third-Party AV Pre-Flight — Warns via Security Center WMI when no non-Microsoft AV is registered before disabling
- Undo / Audit Manifest — Every Disable/Enable writes a JSON audit record to
%ProgramData%\DefenderControl\manifests\; view with-Mode Manifest - PPL Status Dashboard — Shows current Protected Process Light state for WinDefend, WdFilter/WdBoot, and WdNisDrv
- Event Log Source — Writes Disable/Enable start and completion events to the Windows Application log under
DefenderControl - Atomic Undo Replay — Records registry before/after values in manifests and replays the latest Disable manifest during Enable
- MDE / Passive-Mode Preflight — Reports Defender
Normal,Passive,EDR Block Mode, orDisabledstate, platform version, passive-mode policy, MDE onboarding signals, and managed-device warnings before mutation - Support Bundle Export — Creates a ZIP with extended Health JSON, the latest manifest, operation log, recent DefenderControl event entries, crash logs, and optional
MpSupportFiles.cab
| Requirement | Details |
|---|---|
| OS | Windows 10 (1809+) or Windows 11 |
| PowerShell | Windows PowerShell 5.1 (not PowerShell 7) |
| Privileges | Administrator (auto-elevates via UAC) |
| Tamper Protection | Should be OFF for full effectiveness (see below) |
- Download
DefenderControl.ps1 - Right-click → Run with PowerShell (or it will self-elevate)
- Disable Tamper Protection first if you haven't already
- Click Disable Defender or Enable Defender
- Reboot when prompted
For the disable operation to fully persist, Tamper Protection must be turned off manually — Microsoft does not allow programmatic control of this setting.
Windows Security → Virus & Threat Protection → Manage Settings → Tamper Protection → Off
The tool detects Tamper Protection status and warns you if it's still on. Operations will still run, but Windows will silently revert many registry changes.
Check the Dry Run checkbox before clicking Disable or Enable. The tool will log exactly what it would do without making any changes. Useful for auditing or understanding the scope before committing.
# Launch the WPF GUIpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"# Print current Defender statepowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Status
# Extended state: services + PPL + scheduled tasks + policy keys + third-party AVpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Health
# Emit stable JSON for automation pipelinespowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Health -Json
# Create a support bundle on the Desktoppowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode SupportBundle
# Include the optional Microsoft Defender diagnostic CABpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode SupportBundle -MpSupportFiles
# Show CLI usagepowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-HelpHealth JSON includes DefenderMode, DefenderPlatformVersion,
AMRunningMode, ForceDefenderPassiveMode, MDE onboarding/status signals,
managed tamper-protection signals, and ManagedDeviceWarning when local
changes may be overridden by Defender for Endpoint or device policy. Disable
and Enable manifests also record the read-only endpoint snapshot before and
after the operation.
Exit codes:0 success, 1 partial, 2 blocked by Tamper Protection, 3 Safe Mode required, 4 usage / OS error, 5 verification failure.
-Mode Disable and -Mode Enable are reserved — use the GUI for mutating operations. Read-only Status / Health / Verify / Manifest modes are CLI-safe.
Note on elevation: all CLI modes require Administrator privileges. If you invoke the script from a non-elevated shell, it re-launches in a new UAC-elevated window and the CLI output appears there, not in your calling shell. For automation pipelines, elevate the calling shell once (
Start-Process powershell -Verb RunAs) and then invoke the script normally so stdout/stderr return to the caller.
# Assert Defender is fully enabled (exit 0 PASS, exit 5 FAIL, exit 2 if Tamper blocked)powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Verify -Expect Enabled
# Assert Defender is fully disabled after a Disable runpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Verify -Expect Disabled
# Opt-in synthetic detection test (writes a harmless EICAR test file, waits 2.5s, cleans up)powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Verify -Expect Enabled -Eicar -Force
# JSON shape for automation: { expectation, overall, failCount, checks[] }powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Verify -JsonEvery Disable and Enable run writes a JSON audit manifest to %ProgramData%\DefenderControl\manifests\<operation>-<timestamp>.json with firewall before/after snapshots, third-party AV detection, and the list of phases that ran. View the latest:
powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Manifest
powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Manifest -Json
# List manifests and show the default retention policy (30 days / 50 files)powershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Manifest -ListManifests
# Prune old manifests; the explicit age can be adjusted for this runpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Manifest -PruneManifests -RetentionDays 30# Export the latest manifest and operation logs with host/provider/registry data redactedpowershell.exe-ExecutionPolicy Bypass -File "DefenderControl.ps1"-Mode Manifest -Redact -OutputPath "$env:USERPROFILE\Desktop\DefenderControl-Redacted.zip"Manifest retention defaults to 30 days and the newest 50 files. The GUI log controls provide Manifests, Redact, and Prune actions with the same policy. Redacted exports are ZIP archives containing a sanitized manifest and operation log; the original audit files are not modified.
Use the GUI's Support Bundle button or the CLI -Mode SupportBundle to
create a ZIP for troubleshooting. It contains Health.json, the latest audit
manifest (when available), the operation log, recent DefenderControl
Application event entries, recent crash logs, and bundle metadata. Use
-MpSupportFiles or choose the optional diagnostic collection in the GUI to
run Microsoft's MpCmdRun.exe -GetFiles and include MpSupportFiles.cab when
the Defender tool is available. The bundle is written to the Desktop by
default; -OutputPath selects another ZIP path.
Run the full local validation harness from the repository root:
powershell.exe-NoProfile -ExecutionPolicy Bypass -File ".factory\test-all.ps1"The harness checks both PowerShell parsers, validates the functions injected into GUI runspaces, runs the isolated state/verify/transaction/support tests, and fails on any PSScriptAnalyzer rule not listed as a documented baseline.
Build the local release asset from the repository root:
powershell.exe-NoProfile -ExecutionPolicy Bypass -File ".factory\build-release.ps1"The build cleans dist\, creates dist\DefenderControl-v3.3.3.zip containing DefenderControl.ps1, README.md, and LICENSE, then writes release checksums to dist\SHA256SUMS.txt.
| Phase | Action |
|---|---|
| 1 | System Restore Point — Creates a restore point before making changes |
| 2 | Tamper Protection Check — Detects and warns if Tamper Protection is blocking changes |
| 3 | Preferences — Disables 25 Set-MpPreference settings, adds wildcard exclusions for drives/extensions/processes |
| 4 | Group Policy Registry — Sets 19 policy keys (DisableAntiSpyware, DisableRealtimeMonitoring, SpynetReporting, etc.) |
| 5 | Notifications & Systray — Suppresses all Defender notifications, hides system tray icon, disables SecurityHealth autostart |
| 6 | Scheduled Tasks — Disables 5 Defender tasks (Cache Maintenance, Cleanup, Scan, Verification, ExploitGuard) |
| 7 | Services — Sets Start=4 (Disabled) for 8 services with permission escalation, strips PPL flags from 4 core services |
| 8 | Context Menus — Removes "Scan with Microsoft Defender" from right-click menus |
| 9 | Additional — Disables SmartScreen, suppresses signature auto-updates |
| 10 | Processes — Kills non-protected processes, logs PPL status for MsMpEng |
| Phase | Action |
|---|---|
| 1 | Remove Policies — Deletes entire Defender policy registry tree |
| 2 | Restore Preferences — Restores 24 settings to defaults, clears all exclusions |
| 3 | Restore Services — Sets default start types, restores PPL flags, starts services |
| 4 | Scheduled Tasks — Re-enables all 5 tasks |
| 5 | Context Menus & Systray — Restores context menu GUIDs, autostart, notifications, SmartScreen |
| 6 | Signature Update — Triggers Update-MpSignature |
| 7 | Verify — Queries Get-MpComputerStatus to confirm restoration |
- Does not touch Windows Firewall
- Does not delete Defender binaries or Windows components
- Does not modify boot configuration or safe mode settings
- Does not disable Windows Update
- All changes are fully reversible via the Enable button or System Restore
Defender service registry keys (WinDefend, WdFilter, etc.) are protected even from Administrators. The tool uses a 4-level escalation chain:
- Direct write via
Set-ItemProperty— works for unprotected keys - Take ownership + .NET handle — P/Invoke
SeTakeOwnershipPrivilege, set owner to Administrators SID, grant FullControl, write viaRegistryKey.SetValue() - reg.exe — Command-line registry editor sometimes bypasses PowerShell permission constraints
- SYSTEM scheduled task — Creates a one-shot task running as SYSTEM to execute
reg.exe add, verifies the write, then cleans up
The log shows exactly which method succeeded for each key.
MsMpEng.exe (Antimalware Service Executable) runs as a Protected Process Light (PPL) and cannot be killed in the current session. Once services are disabled and PPL flags are stripped, it will not restart after reboot.
Tamper Protection will silently revert registry changes if left on. The tool detects this and warns you, but cannot programmatically disable it.
Windows Home editions lack Group Policy support. Phase 4 registry keys will still be written but may have reduced effectiveness.
Checkpoint-Computer (System Restore) is throttled to one restore point per 24 hours by Windows. If one was created recently, the tool logs a warning and continues.
Some heavily locked service keys may resist all 4 escalation methods. In this case, use a controlled Safe Mode maintenance window.
| Color | Meaning |
|---|---|
| 🔵 Blue | Informational messages |
| 🟢 Green | Successful operations |
| 🟠 Orange | Warnings (non-fatal) |
| 🔴 Red | Errors (operation failed) |
| 🟣 Purple | Phase headers |
| ⚫ Gray | Verbose diagnostics |
MIT License — see LICENSE for details.
This tool is intended for system administrators, IT professionals, and power users who understand the security implications of disabling endpoint protection. Disabling Defender leaves your system vulnerable to malware.
Use at your own risk. Always ensure you have alternative security measures in place when Defender is disabled.