An even funnier way to disable windows defender.
Caution
Permitted Use Notice:
Using this tool to facilitate malware distribution, or any illegal activity is strictly prohibited.
Users assume all legal responsibility for how they use this tool and any consequences thereof. You must comply with all applicable laws when using this tool.
By downloading, installing, or using this tool, you acknowledge that you agree to these terms.
Warning
You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block defendnot binaries from running.
On newer Windows 11 builds you may also have to turn off Smart App Control.
- Real-time protection:
windowsdefender://threatsettings/ - Smart App Control:
windowsdefender://appbrowser/
Open the powershell as administrator and execute any of these:
# Example 1: Basic installation
irm https://dnot.sh/ | iex
# Example 2: With custom AV name and firewall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --name "Custom AV name" --firewall
# Example 3: Without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent
# Example 4: Run once, without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent --disable-autorun
# Example 5: Uninstall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --disableDownload the latest release, extract it somewhere and launch defendnot-loader.
Usage: defendnot-loader [--help] [--version] [--name VAR] [--disable] [--verbose] [--firewall] [--silent] [--autorun-as-user] [--disable-autorun]
Optional arguments:
-h, --help prints help message and exits
--version shows version and exits
-n, --name av display name [default: "dnot.sh"]
-d, --disable disable defendnot
-v, --verbose verbose logging
--firewall also register a fake firewall
--silent do not allocate console
--autorun-as-user create autorun task as currently logged in user
--disable-autorun disable autorun task creation
defendnot only registers a fake AV through WSC, but if you want to strip more Defender stuff out, run the optional extra-strip.bat as admin after defendnot is active. It disables a bunch more Defender policies in registry: real-time monitoring, behavior monitoring, cloud reporting, signature updates, etc.
It's a separate script because the keys are finicky and undoing them on --disable would mean saving every value first somewhere and writing all of them back, which is waaay more bookkeeping than I feel like implementing.
- Needs to stay on disk:
To keep the AV registration after reboot, defendnot adds itself to autorun.
How I ruined my vacation by reverse engineering WSC
- mrbruh for poking me to research this topic
- pindos for providing their machine for WSC service debugging
Apache-2.0