4,608 questions
This blog will show you how to do it. https://www.recastsoftware.com/resources/how-to-create-an-anti-malware-policy-for-endpoint-protection/
Disable Defender realtime scan or stop defender
Ranjithkumar Duraisamy
231
Reputation points
Is there any article to describe, disable defender or stop real-time protection through SCCM antimalware policies or so?
Microsoft Security | Intune | Configuration Manager | Other
2 answers
Sort by: Most helpful
-
Garth 5,801 Reputation points2022-07-13T15:30:10.723+00:00 -
Ranjithkumar Duraisamy 231 Reputation points
2022-07-14T11:30:38.58+00:00 Thanks Garth, This is exactly what I have followed but I'm seeing at the target device is bit weird!
- Local Group policy is set to turn off AV
- Registry doesn't apply the settings and couldn't delete the relevant key/values at all
- Windows Security UI still shows settings are managed by admin and still turned on(Greyed out)
-
Garth 5,801 Reputation points
2022-07-14T13:11:01.67+00:00 Local Group policy will always be overwritten by AD/CM policies.
To be 100% clear you create a CM policy to allow you to disable AV real-time scanning and you force the policy to apply to the computer? -
Ranjithkumar Duraisamy 231 Reputation points
2022-07-14T15:09:15.223+00:00
Sign in to comment -
-
Rahul Jindal 10,911 Reputation points MVP2022-07-13T21:50:06.66+00:00 What is end objective here? Stopping AV like this will lower the security of the devices. If you are trying to troubleshoot or exclude something then there may be other ways to achieve this.
-
Ranjithkumar Duraisamy 231 Reputation points
2022-07-14T11:31:56.54+00:00 I agree and I completely understand that. Asked PROCMON traces as an evidence. but still want to ensure in case needed at later!
Sign in to comment -
