Windows Defender Antivirus is the built-in antimalware program in Windows. Windows Defender is installed by default on all Windows operating systems to protect from viruses, worms, Trojans, and other types of malicious software. Windows Defender is productive enough and has low system requirements. It can be updated online from the Microsoft website or an internal WSUS server. This allows you to use it not only on home computers but also on SMB and enterprise networks. In this article, we will take a closer look at how to manage different settings and enable/disable Windows Defender using PowerShell. Show
The main advantage of the Defender is that it is easy to use, it’s already pre-installed in Windows 10 and 11, enabled by default, and practically doesn’t need manual configuration.  In Windows 11, all Windows Defender features are available in the modern Settings panel through the Windows Security app (you can open it via Settings > Update & Security > Windows Security or by using the quick access UTI command ms-settings:windowsdefender). To manage Windows Defender from the Windows Security GUI, you must have the Microsoft.SecHealthU UWP app installed on your computer. Check UWP application status using PowerShell: Get-AppxPackage Microsoft.SecHealthUI -AllUsers|select Name, Status
In most cases, Windows Defender works well with the default settings, but sometimes the user needs to change its behavior. A large number of settings available from the PowerShell console: through a built-in module Defender. It appeared first time in PowerShell 4.0 and was designed specifically for Windows Defender management. This module contains 11 cmdlets, which we are reviewing today. To display a list of cmdlets contained in the Defender module, run the following command: Get-Command -Module Defender
To get full help on a specific cmdlet of the Defender module, use the Get-Help command: Get-Help Start-MpScan –Full If you need only examples of PowerShell commands, run: Get-Help Add-MpPreference -Examples How to Check if Windows Defender is Running?Before using PowerShell cmdlets to control Windows Defender, it is advisable to check if the service is running. You can use the following PowerShell command to check the service state of Microsoft Defender Antivirus Service (WinDefend), Windows Security Service (SecurityHealthService), and Security Center (wscsvc): Get-Service Windefend, SecurityHealthService, wscsvc| Select Name,DisplayName, Status Get-MpComputerStatus allows you to display the current status of Windows Defender: enabled options, virus definition date and version, last scan time, and others.
To quickly check if Windows Defender is running on your computer and find out the last antivirus definition update date, run the following PowerShell command: Get-MpComputerStatus | Select-Object -Property Antivirusenabled,AMServiceEnabled,AntispywareEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,OnAccessProtectionEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated To display current Windows Defender settings, you can use cmdlet Get-MpPreference. To change the settings, use the Set-MpPreference. In the Windows Defender settings, the IPS, removable disk check, email, and some other checks are disabled by default. For example, you need to enable the scanning of removable drives. Let’s get the current settings using the command: Get-MpPreference | fl disable* In Windows 11 the following Windows Defender features are disabled by default:
As you can see, scanning of removable drives is disabled (DisableRemovableDriveScanning = True). Turn it on using the following command: Set-MpPreference -DisableRemovableDriveScanning $false Also, you can disable some types of Windows Defender scanning. By defaults, Windows Defender scans the archive files (RAR, ZIP, CAB), which can potentially contain malicious files. You can disable archive files scanning using the command: Set-MpPreference -DisableArchiveScanning $True Make sure the new setting is applied: Get-MpPreference|select DisableArchiveScanning After that, the Windows Defender will stop scanning all opened archive files in real-time. Also, to change or remove the antivirus exclusion settings, you can use the Add-MpPreference and Remove-MpPreference cmdlets. For example, let’s add some folder paths to the antivirus exclusions: Add-MpPreference -ExclusionPath C:\Video, C:\install Display a list of path exceptions for Windows Defender: Get-MpPreference | fl excl* To exclude anti-virus scanning of certain processes, run the following command: Set-MpPreference -ExclusionProcess "word.exe", "vmwp.exe" To remove an exception for a specific folder: Remove-MpPreference -ExclusionPath C:\install Windows Defender has a hidden function to protect against unwanted programs (Potentially Unwanted Program — PUP, Potentially Unwanted Application — PUA). By default, it is accessible only in Windows 10/11 Enterprise edition, but with the help of the following command you can enable PUP/PUA protection in any Windows 10 edition: Set-MpPreference -PUAProtection 1 After you turn on protection, when you try to launch or install potentially unwanted programs on your computer, you will receive the following notification from Defender in Windows 10.
Use PowerShell to Update Windows Defender SignaturesTo start the antivirus signature update, you can use the command Update-MpSignature. By default, the Windows Defender receives updates from online Microsoft Update Servers. You can use the UpdateSource argument to specify where you want to receive the virus definition updates from. The following virus definition sources are available:
To update antivirus from a network shared folder on a Windows file server you need to download the necessary definition update files and place them into a shared network folder. Then you have to specify that Windows Defender should be updated from a file share source (use UNC path): Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\DESKTOP-V20E3PO\Updates To run virus update and malware definitions manually: Update-MpSignature -UpdateSource FileShares In some cases, after receiving an incorrect update, Windows Defender may not work correctly. In this case, it is recommended to reset the current thread definition databases and reload them from source: "%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" -RemoveDefinitions -All How to Perform Virus Scan with Microsoft Defender?To perform an antivirus scanning of your computer, use the Start-MpScan cmdlet. With the ScanType argument, you can choose one of three scan modes:
For example, run a custom scan to check the system folder “C:\Program Files”: Start-MpScan -ScanType CustomScan -ScanPath ”C:\Program Files” You can perform a full computer scan by Windows Defender using the command: Start-MpScan -ScanType FullScan Or quick threats scan: Start-MpScan -ScanType QuickScan To remove all active threat on your computer, use the command: Remove-MpThreat All Defender module cmdlets can be performed both for the local and remote computers. To connect to a remote computer, you need to use the CimSession option. For example, to get the date of the last scan from the remote computer with hostname lnd_wks21, run the following commands (WinRM must be enabled): $session = NewCimSession -ComputerName lnd_wks21 You can use the Start-MpWDOScan cmdlet to perform an offline scan with Windows Defender. After executing this command, your operating system will automatically reboot. Windows Defender will start in a special boot environment and scan your device for threats before your Windows boots. How to Disable and Remove Windows Defender using PowerShell?If you want to disable Defender real-time protection: Set-MpPreference -DisableRealtimeMonitoring $true To completely disable Windows Defender on a computer, use the command: New-ItemProperty -Path “HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender” -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force On Windows client-based operating system (like Windows 10/Windows 8.1) you cannot completely uninstall the Windows Defender feature. The only available option is to disable it using the registry key DisableAntiSpyware = 1 or using the Local Group Policy Editor.
In Windows 11, before disabling Windows Defender through the registry or a GPO, you must manually disable the Tamper Protection feature. Tamper Protection prevents changes to Windows Defender security features via PowerShell, registry settings, and/or Group Policy options. Tamper Protection is enabled in Windows 11 by default. You can check this option state using PowerShell: Get-MpComputerStatus | select IsTamperProtected You can only disable it using the Windows Security app. Go to “Virus & Threat Protection” > click “Manage Settings” > scroll down to “Tamper Protection” and move the slider to the “Off” position. Confirm this action at the UAC prompt. Note that the following message has appeared: Tamper protection is off. Your device may be vulnerable. You can uninstall Windows Defender on Windows Server 2016\2019 using PowerShell. Just run the following command in the elevated PowerShell session: Uninstall-WindowsFeature -Name Windows-Defender –whatif Or use the DISM tool: Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet How to Reset Windows Defender to Default?You can reset all Windows Defender settings using the Windows Security App.
I enjoy technology and developing websites. Since 2012 I'm running a few of my own websites, and share useful content on gadgets, PC administration and website promotion. How do I completely turn off Windows Defender from PowerShell?Open Start. Search for PowerShell, right-click the top result, and select the Run as administrator option. Type the following command to temporarily disable Microsoft Defender Antivirus and press Enter: Set-MpPreference -DisableRealtimeMonitoring $true.
How do I remove a firewall rule in PowerShell?The Remove-NetFirewallRule cmdlet permanently deletes one or more firewall rules from the specified policy store. This cmdlet gets one or more firewall rules to be deleted with the Name parameter (default), the DisplayName parameter, rule properties, or by associated filters or objects.
How do I disable Windows Firewall with script options?Using the code or text editor of your choice, create a new file with name Disable-Windows-Firewall. ps1. Edit the script and add this line of code: netsh advfirewall set allprofiles state off . Save the script when done.
How enable Windows Firewall PowerShell?In Powershell, you can easily enable or disable Windows Firewall using the Set-NetFirewallProfile command. This cmdlet is used to configure the Firewall's advanced security settings for a particular, or all, network profile.
|
Turn off Windows Defender Firewall Windows 10 PowerShell
Copyright © 2024 menakung Inc.
