How to Disable, Enable, and Manage Microsoft Defender Using PowerShell?

7.7K

This guide explains how to use PowerShell to enable/disable Microsoft Defender on Windows, how to manage various settings, and scan the computer for threats and viruses.

What is Microsoft Defender?

Microsoft Defender Antivirus is the built-in antivirus solution included with all supported editions of Windows 10 and Windows 11. Users can manage the Microsoft Defender antivirus from the Windows Security app GUI or using the PowerShell command line.

How to Check the Microsoft Defender Status with PowerShell

Open an elevated PowerShell prompt and check the current status of Microsoft Defender with the command:

Get-MpComputerStatus

Or quickly check if Microsoft Defender is on, which protection settings are enabled, and when antivirus definitions were last updated:

Get-MpComputerStatus | Select-Object -Property Antivirusenabled,AMServiceEnabled,AntispywareEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,OnAccessProtectionEnabled,RealTimeProtectionEnabled,IsTamperProtected,AntivirusSignatureLastUpdated

If Defender Antivirus is disabled, check the following service statuses on a computer:

• Microsoft Defender Antivirus Service (WinDefend)
• Windows Security Service (SecurityHealthService),
• Security Center (wscsvc)

Get-Service WinDefend, SecurityHealthService, wscsvc| Select Name,DisplayName,Status

Only Windows desktop operating systems (such as Windows 11 or 10) have Microsoft Defender antivirus pre-installed.

Check Microsoft Defender Platform and Engine Versions

When troubleshooting Microsoft Defender issues, it is useful to verify not only the antivirus signature version but also the installed Defender platform and engine versions. Some Defender features and bug fixes are delivered through platform updates rather than signature updates.

Run the following command to display the current Microsoft Defender platform, engine, and signature versions:

Get-MpComputerStatus |
Select-Object AMProductVersion, AMEngineVersion, AntivirusSignatureVersion

This info will be useful for you when comparing systems, verifying that Defender platform updates have been installed successfully, or troubleshooting issues after Microsoft Defender engine updates.

AMRunningMode property shows whether Microsoft Defender Antivirus is running in Normal, Passive, or EDR Block Mode, which is especially useful on devices protected by Microsoft Defender for Endpoint/third-party antivirus software:

Get-MpComputerStatus |
Select-Object AMRunningMode

Check Microsoft Defender for Endpoint Onboarding Status

You can manage Microsoft Defender Antivirus through Microsoft Defender for Endpoint (MDE). First, let’s check if the MDE sensor is running:

Get-Service Sense

A running Sense service indicates that the MDE sensor is installed and active, but does not by itself confirm successful onboarding/healthy communication with the Defender portal.

In order to check the Defender Antivirus operating mode, run the following command:

Get-MpComputerStatus |
Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled

• Normal — Defender Antivirus is active.
• Passive — Defender Antivirus is not the primary antivirus, while MDE can still provide EDR capabilities.
• EDR Block Mode — MDE can block and remediate threats detected by EDR even when Defender Antivirus is in passive mode.

Note. For authoritative MDE onboarding and sensor-health status, you should verify the device in the Microsoft Defender portal.

How to Disable or Enable Microsoft Defender Protection using PowerShell

In Windows 10 and 11, you can temporarily pause Microsoft Defender protection or turn it off completely.

How to Temporarily Disable (Pause) the Defender Antivirus Protection on Windows

There is a built-in security feature called Tamper Protection that has been available since Windows 10 version 1903 and is enabled by default on modern Windows 10 and Windows 11 devices. This feature prevents users from modifying Microsoft Defender settings through PowerShell, the registry, or Group Policy unless Tamper Protection is turned off.

Managing Tamper Protection settings

Check the Tamper Protection state:

Get-MpComputerStatus | select IsTamperProtected

Note that in case Tamper Protection is enabled, the commands may fail.

Tamper Protection can only be disabled from the Windows Security UI. Go to “Virus & Threat Protection” > click “Manage Settings” > scroll down to “Tamper Protection” and move the slider to the “Off” position.

Tamper protection is off. Your device may be vulnerable.

Now disable Microsoft Defender real-time protection with PowerShell:

Set-MpPreference -DisableRealtimeMonitoring $true

Disable the cloud-delivered protection:

Set-MpPreference -MAPSReporting Disabled

If a Set-MpPreference command doesn’t apply the requested setting, you need to verify that Tamper Protection is disabled. Modern Windows versions block many Defender configuration changes while Tamper Protection is enabled.

This will suspend antivirus protection in Windows until the next restart.

To restore real-time protection, run:

Set-MpPreference -DisableRealtimeMonitoring $false

Turn on cloud-delivered protection:

Set-MpPreference -MAPSReporting Advanced

Permanently Turn Off Microsoft Defender on Windows 11 or 10

If you have a third-party certified AV solution installed on the computer, Microsoft Defender antivirus will automatically switch to passive EDR or block mode. But in some cases, you may to completely disable Microsoft Defender on a computer without installing third-party AV.

In earlier versions of Windows, the Microsoft Defender Antivirus can be disabled using the GPO option Turn off Windows Defender Antivirus (Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus) or with the DisableAntiSpyware = 1 registry parameter. However, these options no longer completely disable Microsoft Defender Antivirus in the latest Windows 10 and 11 builds.

Completely disable Microsoft Defender

Warning. This is an unsupported method and you should only use it for temporary troubleshooting/isolated lab environments. Changes made to Defender service config may be reverted after a normal reboot, policy refresh, Defender/Microsoft Defender for Endpoint remediation, or platform update. Do not use this technique as a permanent method for disabling Defender on production/enterprise-managed devices.

One of the methods to completely disable Microsoft Defender is to restart your computer in Safe Mode and prevent the Defender services from starting. Follow the next steps:

1. To boot Windows into the Safe Mode, run:
   

   bcdedit /set {current} safeboot minimal
   
   shutdown -r -t 0

   
2. Open the Registry Editor (regedit.exe) after booting into Safe Mode
3. Then open the following registry keys one by one and change the value of the Start registry parameter in each key to 4
   
4. Now turn off the Safe Mode Boot mode and restart Windows:
   

   bcdedit /deletevalue {current} safeboot

   
   

   

   Sign into Windows with your account and check that Microsoft Defender is now disabled.

In order to check if Microsoft Defender is no longer actively protecting the device by checking its current running mode and real-time protection status, run the command:

Get-MpComputerStatus |
Select-Object AMRunningMode, RealTimeProtectionEnabled

If Microsoft Defender has been successfully disabled, RealTimeProtectionEnabled should be False. Depending on your config, the AMRunningMode value may also indicate that Defender is no longer operating in its normal protection mode.

Registry key	Parameter	Default Value	New value (disable defender)
HKLM\SYSTEM\CurrentControlSet\Services\Sense\	Start	3	4
HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\	Start	0	4
HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\	Start	0	4
HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\	Start	3	4
HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\	Start	3	4
HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\	Start	2	4

Important. Changes made to Defender service Start values in Safe Mode are not guaranteed to persist. After Windows starts normally, Microsoft Defender, Tamper Protection, Microsoft Defender for Endpoint, or centrally managed security policies may restore/reapply the expected service config. Platform updates can also restore Defender components. Therefore, you should treat this method as a temporary, unsupported troubleshooting technique rather than a permanent way to disable Microsoft Defender.

Warning. The WdBoot and WdFilter services are involved in the early Windows boot process. Manually changing their Start values to 4 is a low-level, unsupported modification and can cause boot/security-initialization problems. On systems using Secure Boot, BitLocker, Microsoft Defender for Endpoint, or other endpoint security controls, the change may also conflict with platform or security policy enforcement. Do not use this procedure on production/enterprise-managed devices.

Uninstall Windows Defender on Windows Server 2019/2016 using PowerShell

Installing Microsoft Defender on Server 2019/2016

Microsoft Defender is not pre-installed by default on Windows Server 2019/2016 platforms. It can be installed as an additional feature:

Install-WindowsFeature -Name Windows-Defender

Removing Microsoft Defender feature

If you want to uninstall Windows Defender on a Windows Server, remove the feature:

Uninstall-WindowsFeature -Name Windows-Defender

Manage Microsoft Defender Using PowerShell

Microsoft.SecHealthUI is a graphical UWP app that can be used for the management of Microsoft Defender on Windows 10 and 11 (available via Settings > Privacy & Security > Windows Security or with the ms-settings:windowsdefender command).

Listing available Defender commands

All of the Microsoft Defender configuration settings that are available in the Windows Security app can be performed using the PowerShell cmdlets of the built-in Defender module. List available cmdlets in this module:

Get-Command -Module Defender

You can get help about a specific cmdlet from the Defender module:

Get-Help Start-MpScan –Full

Or only list examples:

Get-Help Add-MpPreference -Examples

The following Microsoft Defender preference parameters are disabled by default. Note that these parameters use different naming conventions: Disable* parameters disable a feature when set to $true, while Enable* parameters enable a feature when set to $true. Therefore, an Enable* parameter set to $false means that the corresponding feature is disabled by default.

• DisableCatchupFullScan
• DisableCatchupQuickScan
• DisableCpuThrottleOnIdleScans
• DisableEmailScanning
• DisableRemovableDriveScanning
• DisableRestorePoint
• DisableScanningMappedNetworkDrivesForFullScan
• EnableFileHashComputation
• EnableFullScanOnBatteryPower
• EnableLowCpuPriority

For example, enable automatic scanning of removable drives:

Set-MpPreference -DisableRemovableDriveScanning $false

Because the parameter name uses negative logic, setting -DisableRemovableDriveScanning to $false enables scanning of removable drives. Conversely, setting it to $true disables removable drive scanning.

Disable real-time scanning of archive files (files (RAR, ZIP, CAB):

Set-MpPreference -DisableArchiveScanning $True

Enable protect against unwanted programs (Potentially Unwanted Program — PUP, Potentially Unwanted Application — PUA):

Set-MpPreference -PUAProtection 1

Manage Microsoft Defender antivirus exclusions

• Add paths to the antivirus exclusions:
  

  Add-MpPreference -ExclusionPath C:\Video, C:\install

• Remove a folder exclusion:
  

  Remove-MpPreference -ExclusionPath C:\install

• Exclude process from real-time antivirus scanning:
  

  Set-MpPreference -ExclusionProcess "word.exe", "vmwp.exe"

• Exclude specific file extensions from Microsoft Defender scan:
  

  Set-MpPreference -ExclusionExtension ".mp3",".mp4",".wav"

Manage Attack Surface Reduction (ASR) Rules

Microsoft Defender Attack Surface Reduction (ASR) rules help protect Windows devices from common attack techniques (such as malicious Office files, credential theft, ransomware, and other behavior commonly associated with malware). ASR rules are especially important in enterprise environments and you can configure it with PowerShell through Set-MpPreference. To view the currently configured ASR rules, run the following command:

Get-MpPreference |
Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

You can configure ASR rules using two corresponding arrays:

• AttackSurfaceReductionRules_Ids — contains the GUIDs of the ASR rules.
• AttackSurfaceReductionRules_Actions — specifies the action for each rule.

The action values are:

0 — Disabled
1 — Block
2 — Audit
6 — Warn

For example, to configure an ASR rule in Audit mode, use the command below:

Set-MpPreference -AttackSurfaceReductionRules_Ids "RULE-GUID" -AttackSurfaceReductionRules_Actions Audit

In order to enable the same rule in Block mode, run the command:

Set-MpPreference -AttackSurfaceReductionRules_Ids "RULE-GUID" -AttackSurfaceReductionRules_Actions Block

Important. ASR rules can affect legitimate apps and admin workflows. In enterprise environments, you should test rules in Audit mode before enabling Block mode and deploy them through centralized security policy management when possible.

Manage Controlled Folder Access

Controlled Folder Access is a Microsoft Defender feature designed to protect important folders from unauthorized changes by untrusted apps. It can help you to reduce the impact of ransomware and other malware that attempts to modify/encrypt user files. In order to check the current Controlled Folder Access config, run the command:

Get-MpPreference |
Select-Object EnableControlledFolderAccess

The setting can have the following values:

0 — Disabled
1 — Enabled
2 — Audit mode

To enable Controlled Folder Access, run the following command:

Set-MpPreference -EnableControlledFolderAccess Enabled

To enable Audit mode without blocking apps:

Set-MpPreference -EnableControlledFolderAccess AuditMode

To disable Controlled Folder Access, use the command below:

Set-MpPreference -EnableControlledFolderAccess Disabled

Important. Controlled Folder Access can block legitimate apps from modifying protected folders. In enterprise environments, you should test the policy in Audit mode first and config required app exclusions/allow rules before enforcing Block mode. For centrally managed devices, you should use an appropriate Intune, Microsoft Defender, Configuration Manager, or Group Policy policy rather than configuring individual endpoints manually.

Disable Microsoft Defender user interface (UI)

Set-MpPreference -UILockdown $true

‘Virus and threat protection’ section will be hidden from the Windows Security UI.

Update Microsoft Defender signatures

Update-MpSignature

Update antivirus definitions from a shared network folder on your LAN. Download the necessary definition update files and set an UNC path as the default update source:

Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\DESKTOP-V20E3PO\Updates

Update the virus and malware definitions:

Update-MpSignature -UpdateSource FileShares

Update-MpSignature

After updating the signatures, you can verify that the update completed successfully and check the currently installed signature version and its installation time by running the command below:

Get-MpComputerStatus |
Select-Object AntivirusSignatureVersion, AntivirusSignatureLastUpdated

This command allows you to confirm that Microsoft Defender is using the latest antivirus definitions and helps troubleshoot situations where signature updates fail/outdated definition database is still in use.

Running Microsoft Defender Scans with PowerShell

Start-MpScan -ScanType CustomScan -ScanPath "C:\Program Files"

Perform a full computer scan:

Start-MpScan -ScanType FullScan

Or quick threats scan:

Start-MpScan -ScanType QuickScan

Offline scan with Start-MpWDOScan

Run an offline scan by booting into an isolated WinPE environment.

Start-MpWDOScan

Viewing and Removing Threats with PowerShell

Get-MpThreat

List of active and past malware detections:

Get-MpThreatDetection |
Sort-Object InitialDetectionTime -Descending

To remove all active threats:

Remove-MpThreat

Manage Microsoft Defender on Multiple Computers

Prerequisites for Remote Management

You must enable PowerShell remoting on the target machines before using Invoke-Command or remote CIM sessions. On computers that are not already configured for PowerShell remoting, you need to run the following command in an elevated PowerShell session:

Enable-PSRemoting -Force

This enables the WinRM service and configures the required firewall rules for PowerShell remoting.

In enterprise environments, you need to config and manage WinRM through Group Policy/your organization’s endpoint-management platform rather than enabling it manually on individual machines.

In enterprise environments, admins rarely manage Microsoft Defender on a single machine. Instead, you should use PowerShell Remoting, CIM sessions, and scripting to perform the same operation across multiple devices simultaneously.

Checking Defender Status on Multiple Machines

Once PowerShell remoting is configured and you have the required permissions, you can query Defender on remote machines with Invoke-Command.

The example below uses Invoke-Command to retrieve the Defender status from several remote computers at once. Run the following command:

Invoke-Command -ComputerName PC01,PC02,PC03 -ScriptBlock {
Get-MpComputerStatus |
Select-Object CSName, AntivirusEnabled, RealTimeProtectionEnabled
}

Update Defender Signatures on Multiple Devices

You can also trigger a signature update on multiple machines with a single command:

Invoke-Command -ComputerName PC01,PC02,PC03 -ScriptBlock {
    Update-MpSignature

    Get-MpComputerStatus |
    Select AntivirusSignatureVersion
}

Run Defender Commands Against a List of Computers

If you have a large number of devices, you can store their names in a text file and execute Defender commands against each machine. Here is an example:

$Computers = Get-Content C:\Temp\Computers.txt

$Computers | ForEach-Object {
Invoke-Command -ComputerName $_ -ScriptBlock {
Start-MpScan -ScanType QuickScan
}
}

Query Defender Using CIM Sessions

CIM sessions provide an efficient way to collect Defender info from multiple remote machines without opening an interactive PowerShell session. Use the command:

$Sessions = New-CimSession -ComputerName PC01,PC02,PC03

Get-MpComputerStatus -CimSession $Sessions |
Select-Object PSComputerName, AntivirusEnabled, RealTimeProtectionEnabled

Remove-CimSession $Sessions

These methods allow you to manage Microsoft Defender across many computers from a central management workstation and are commonly used in enterprise environments.

Exporting Microsoft Defender Reports

You can export Microsoft Defender config, health status, and threat info for reporting/troubleshooting purposes.

In order to export the current Defender config, run the command:

Get-MpPreference | Export-Csv -Path C:\Reports\DefenderPreferences.csv -NoTypeInformation

You can export the current Defender status with the command:

Get-MpComputerStatus | Export-Csv -Path C:\Reports\DefenderStatus.csv -NoTypeInformation

To export detected threats:

Get-MpThreatDetection | Export-Csv -Path C:\Reports\DefenderThreats.csv -NoTypeInformation

To generate a quick text report for review, use the following:

Get-MpComputerStatus | Out-File C:\Reports\DefenderStatus.txt

These reports are useful for troubleshooting, documenting security settings, and collecting Microsoft Defender info from multiple machines during admin audits.

Wrapping Up

Microsoft Defender can be fully managed from PowerShell, making it suitable for both standalone machines and enterprise environments. In case you need to check protection status, update signatures, config exclusions, perform malware scans, or automate Defender management across hundreds of devices, the built-in Defender PowerShell module provides all the necessary tools.