Step 1: Disable Real-time monitoring immediately to minimize current runtime memory resource utilization
Set-MpPreference -DisableRealtimeMonitoring $true
Step 2: Remove Windows Defender
# This works well on Server OS 
Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
# Uninstall-WindowsFeature -Name Windows-Defender # Alternate command
# This only works on Client OS, not Server OS
$winDefendHive='REGISTRY::HKLM\SOFTWARE\Policies\Microsoft\Windows Defender'
$keyName='DisableAntiSpyware'
$disableValue=1
New-ItemProperty -Path $winDefendHive -Name $keyName -Value $disableValue -PropertyType DWORD -Force
# This error would occurs because Windows Defender on servers do not have this registry hive
New-ItemProperty : Cannot find path 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender' because it does not exist.
At line:1 char:1
+ New-ItemProperty -Path 'REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Policie ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (HKEY_LOCAL_MACH...indows Defender:String) [New-ItemProperty], ItemNotFoundException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.NewItemPropertyCommand
Alternative Method: Disable WinDefend via local GPO

Run gpedit.msc > Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus >
set Turn off Windows Defender Antivirus = Enabled, Turn off real time protection = Disabled > close gpedit > run ‘gpupdate /force’

Other Commands:
?
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
# How to add permissions to WinDefend Registry hive
$winDefenderKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SYSTEM\CurrentControlSet\Services\WinDefend",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
$acl = $winDefenderKey.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule("Builtin\Administrators","FullControl","ContainerInherit","None","Allow")
$acl.AddAccessRule($rule)
$winDefenderKey.SetAccessControl($acl)
 
# How to set the startup type of the Windows Defender's service to "Automatic"
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend -Name Start -Value 0x00000002
 
# How to set Windows Defender's service to disable on startup
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend -Name Start -Value 0x00000003
 
# Check WinDefend settings
Get-MpComputerStatus | Select-Object -Property Antivirusenabled,AMServiceEnabled,AntispywareEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,OnAccessProtectionEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated
 
# Kill WinDefend using the old-school DISM tool
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
?
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
# Example on uninstallation of AV and WinDefend - to be followed up with Installating a new AV
$computernames=@(
    'SERVER0001',
    'SERVER0002',
    'SERVER0003'
    )
$installFile='C:\Temp\xdr6.1.1.msi'
$uninstallPassword='UNINSTALLPASSWORD'
foreach ($computername in $computernames){
    copy-item $installFile -destination "\\$computername\c$\Temp"
    $localInstallFile="C:\Temp\$(split-path $installFile -leaf)"
    invoke-command -computername $computername -scriptblock{
        param($installFile,$uninstallPassword,$logFolder)
        # Uninstall Old AV        $uninstallLogFile="C:\Temp\$env:computername`_uninstallLogFile.txt"
        msiexec.exe /x $installFile /l*v $uninstallLogFile UNINSTALL_PASSWORD=$uninstallPassword
        # b. Remove/Disable Windows Defender:
        Set-MpPreference -DisableRealtimeMonitoring $true
        Uninstall-WindowsFeature -Name Windows-Defender
        # Restart-Computer
    } -args $localInstallFile,$uninstallPassword   
}
Categories: