Set-MpPreference -DisableRealtimeMonitoring 0 Solution 4: Using the Registry EditorĮditing the Registry is another possible fix for this issue.

Click Settings, you are looking for a button labeled “Real Time Protection.” Make sure it is on.Īnother solution is to run the following command from PowerShell – make sure to Run As Administrator.

Click the Start button and type Windows Defender, and double click the icon for Windows Defender Security Center – this might be slightly different depending on your version of Windows.

Solution 2: User SettingsĪnother option to re-enable Windows Defender is in the Control Panel Settings. You should be able to run Windows Defender after you update this GPO. You will need local administrative rights to make this change

“Turn off Windows Defender” should be set to Enable if you can’t run Windows Defender.

Select Windows Defender and in the right panel and double click the setting “Turn off Windows Defender”.

Select Local Computer Policy -> Administrative Templates -> Windows Components.

As a security practitioner, you might want to check several of these settings and a few other items (i.e., malware, AD event logs, ) for evidence of tampering. If you experience or one of your user’s reports this kind of error, you have several options to re-enable Defender. 5 Solutions for Windows Defender Turned Off by Group Policy There are other methods attackers use to disable Defender, but the group policy method makes it more difficult for the user to re-enable it. Sometimes they will use a local group policy to disable Defender. Sometimes they could use group policy to disable Windows Defender on multiple machines – depending on their level of access – so they can move more easily between several computers on your network.

Just make a new disableDefender.Get the Free PowerShell and Active Directory Essentials Video CourseĪttackers know Windows Defender can detect cyberattacks, so as part of their standard playbook they attempt to disable Defender. It gives me then the following answer, which looks good.

I needed to disable Windows defender because I installed a software which I modified with orca (MSI modification), and defender kind of blocked it.įound this 'long' solution on this link.

Enable windows defender powershell