Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions docs/powershell/disable-defender.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
---
id: '3e5e318a-85f8-408f-81fb-509c5afe18c9'
slug: /3e5e318a-85f8-408f-81fb-509c5afe18c9
title: 'Disable Defender'
title_meta: 'Disable Defender'
keywords: ['Windows Defender', 'SentinelOne', 'antivirus', 'real-time protection']
description: 'Disables Windows Defender real-time protection when a supported third-party antivirus service is detected.'
tags: ['security']
draft: false
unlisted: false
last_update:
date: 2025-06-04
---

## Description

Disables Windows Defender real-time protection when a supported third-party antivirus service is detected. If Defender is already disabled, no action is taken.

## Requirements

- PowerShell 5+
- Administrative privileges

## Process

1. Checks for the presence of a supported third-party antivirus service (currently SentinelOne).
2. If no supported AV service is found, exits without changes.
3. Queries Windows Defender real-time protection status.
4. If Defender is already disabled, exits without changes.
5. Disables Defender real-time protection.

## Usage

Checks for SentinelAgent service and disables Defender if it is enabled.

```powershell
.\Disable-Defender.ps1
```

## Supported Antivirus Products

| Product | Service Name |
|--------------|----------------|
| SentinelOne | SentinelAgent |

Additional products can be added to the `$supportedAVServices` array in the script.

## Output

.\Disable-Defender-log.txt
.\Disable-Defender-error.txt

## Changelog

### 2025-06-04

- Initial version of the document
Loading