Windows Defender (AV) not disabling

Question

I work for a MSP, and our client has Cylance. For some reason, Windows Defender (AV) will not disable.

Endpoints in question: Windows 10 Pro, domain joined

Domain functional level: Windows Server 2012 R2

My first attempt was to configure a domain GPO: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender > Turn off Windows Defender = Enabled

I confirmed the endpoints restarted and took the GPO. However, Get-MpComputerStatus returns:

BehaviorMonitorEnabled    : True

IoavProtectionEnabled     : True

IsTamperProtected         : True

NISEnabled                : True

OnAccessProtectionEnabled : True

RealTimeProtectionEnabled : True

I then invoked: Set-MpPreference -DisableBehaviorMonitoring $True -DisableIntrusionPreventionSystem $True -DisableIOAVProtection $True -DisableRealtimeMonitoring $True -DisableScriptScanning $True -DisableArchiveScanning $True -DisableCatchupFullScan $True -DisableCatchupQuickScan $True -DisableEmailScanning $True -DisableRemovableDriveScanning $True -DisableRestorePoint $True -DisableScanningMappedNetworkDrivesForFullScan $True -DisableScanningNetworkFiles $True

But Get-MpComputerStatus still returns:

BehaviorMonitorEnabled    : True

IoavProtectionEnabled     : True

IsTamperProtected         : True

NISEnabled                : True

OnAccessProtectionEnabled : True

RealTimeProtectionEnabled : True

Please advise how to completely disable Windows Defender (AV). However, please keep in mind I want to keep Windows Defender Firewall enabled.

Thanks!

Answer 1

In general when you deploy another Anti-Malware product it should disable Windows Defender and you shouldn't take any action. Try check this issue with their support.

Your question is technical and it is better to ask it in windows-10-security - Microsoft Q&A

Answer 2

Welcome, glad it was helpful.

Answer 3

Will do. Thank you for the guidance.