Readme.md
March 20, 2022 ยท View on GitHub
Disable Windows Defender via registry
An easy tool to disable and enable windows defender protections
Install & Compile
nimble install winregistry winim cligen
nim c -x -f Fdefender.nim
How to use
| Protection | Command |
|---|---|
| Disable all protections | Fdefender.exe -D |
| Enable all protections | Fdefender.exe -E |
| Disable Automatic sample submission | Fdefender.exe -S --Off |
| Enable Automatic sample submission | Fdefender.exe -S --On |
| Disable Real-Time protection | Fdefender.exe -R --Off |
| Enable Real-Time protection | Fdefender.exe -R --On |
| Disable Cloud-Delivered protection | Fdefender.exe -C --Off |
| Enable Cloud-Delivered protection | Fdefender.exe -C --On |
| Disable Network Protection | Fdefender.exe -N --Off |
| Enable Network Protection | Fdefender.exe -N --On |
| Disable Controlled folder access | Fdefender.exe -F --Off |
| Enable Controlled folder access | Fdefender.exe -F --On |
You can also combine flags in order to disable/enable many protections together.
Fdefender.exe -FRS --On | Fdefender.exe -FRS --Off
All Flags must start with Capital letters: Info, Off, On.
Good To Mention
I want to mention that the following technique to turn on and off "windows defender" came from the necessity to quickly turn off "windows defender" on a computer managed by an organization. The registry values under: "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" They appear only if the computer is under an organization.
BUT
It still works on a computer that is not managed. All you have to do is execute "Fdefender.exe -E" which will enable all defender protections in order to create the values we need under the key above. After that, you can manage your defender via this tool.
TODO
- Auto Privilege escalation using exploit/Vul driver