defendnot

August 15, 2026 · View on GitHub

An even funnier way to disable windows defender.

Caution

Permitted Use Notice:

Using this tool to facilitate malware distribution, or any illegal activity is strictly prohibited.

Users assume all legal responsibility for how they use this tool and any consequences thereof. You must comply with all applicable laws when using this tool.

By downloading, installing, or using this tool, you acknowledge that you agree to these terms.

Installation

Warning

You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block defendnot binaries from running.

On newer Windows 11 builds you may also have to turn off Smart App Control.

Real-time protection: windowsdefender://threatsettings/
Smart App Control: windowsdefender://appbrowser/

One-liner

Open the powershell as administrator and execute any of these:

# Example 1: Basic installation
irm https://dnot.sh/ | iex

# Example 2: With custom AV name and firewall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --name "Custom AV name" --firewall

# Example 3: Without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent

# Example 4: Run once, without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent --disable-autorun

# Example 5: Uninstall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --disable

Manual

Download the latest release, extract it somewhere and launch defendnot-loader.

Usage

Usage: defendnot-loader [--help] [--version] [--name VAR] [--disable] [--verbose] [--firewall] [--silent] [--autorun-as-user] [--disable-autorun]

Optional arguments:
  -h, --help         prints help message and exits
  --version          shows version and exits
  -n, --name         av display name [default: "dnot.sh"]
  -d, --disable      disable defendnot
  -v, --verbose      verbose logging
  --firewall         also register a fake firewall
  --silent           do not allocate console
  --autorun-as-user  create autorun task as currently logged in user
  --disable-autorun  disable autorun task creation

Stripping Defender out further (optional)

defendnot only registers a fake AV through WSC, but if you want to strip more Defender stuff out, run the optional extra-strip.bat as admin after defendnot is active. It disables a bunch more Defender policies in registry: real-time monitoring, behavior monitoring, cloud reporting, signature updates, etc.

It's a separate script because the keys are finicky and undoing them on --disable would mean saving every value first somewhere and writing all of them back, which is waaay more bookkeeping than I feel like implementing.

Limitations

Needs to stay on disk:
To keep the AV registration after reboot, defendnot adds itself to autorun.

Writeup

How I ruined my vacation by reverse engineering WSC

Special thanks

mrbruh for poking me to research this topic
pindos for providing their machine for WSC service debugging

License

Apache-2.0