Microsoft because it does not allow Defender to be disabled

As we mentioned in previous publication η has removed the ability to disable Microsoft Defender from the Windows 10 Registry.

Since Windows Vista, users could completely disable Microsoft Defender and potentially any other security software by using “Turn off Microsoft Defender Antivirus” in its settings policy.

When the policy is enabled, a registry key “DisableAntiSpyware” and set to 1 under the key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\, as shown below.

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows Defender] "DisableAntiSpyware" = dword: 00000001

Once enabled, this key will disable "Microsoft Defender Antivirus and third-party antivirus software and applications."

At documentation of DisableAntiSpyware, Microsoft states that the DisableAntiSpyware value will be ignored and will not now for disabling anti-virus software.

Microsoft also states that if a user removes the installed antivirus solution, Windows Defender will automatically activate to protect him / her.

"Consumers may choose to run another AV solution, but if for any reason the application is disabled, Microsoft Defender AV will be reactivated to ensure that there is no user protection gap. ”


Just as Windows administrators know about group policy settings in DisableAntiSpyware, so do malware developers.

Many malicious programs (TrickBot, Novter, Clop Ransomware, Ragnarok Ransomware, and AVCrypt Ransomware) have abused this policy to try to disable antivirus protection on Windows.

With the release of Windows 10 1903, Microsoft added a new feature called Tamper protection which prevents Windows Security and Microsoft Defender settings from being changed by programs, tools ς of Windows, registry changes, or group policy changes.

Έτσι αν ένα κακόβουλο λογισμικό πρόσθετε την τιμή DisableAntiSpyware στο Μητρώο και έπειτα πραγματοποιούσε επανεκ  στον υπολογιστή, κατά την επανεκκίνηση, το Tamper will remove the value.

So now that Microsoft Defender is completely ignoring the value of DisableAntiSpyware, Windows 10 users have much greater protection against threats trying to disable security software using this technique. The Best Technology Site in Greecefgns

Subscribe to Blog by Email

Subscribe to this blog and receive notifications of new posts by email.

Written by giorgos

George still wonders what he's doing here ...

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).