How to Disable Windows Defender on Windows Server 2019 and 2022

Before disabling Microsoft Defender Antivirus, create a system restore point and prepare your alternative security solution. This prevents leaving your server unprotected.

Enable-ComputerRestore -Drive "C:"
Checkpoint-Computer -Description "Before Defender Disable" -RestorePointType "MODIFY_SETTINGS"

Verify the restore point was created:

Get-ComputerRestorePoint | Select-Object -Last 1

Download and prepare your third-party antivirus installer but don't install it yet. Popular enterprise options include Symantec Endpoint Protection, CrowdStrike Falcon, or SentinelOne.

First, verify which Defender components are currently installed and active on your server. This helps you understand what needs to be disabled.

Get-WindowsFeature -Name *Defender*

Check the current status of Defender services:

Get-Service -Name *Defender* | Select-Object Name, Status, StartType

View real-time protection status:

Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableIOAVProtection

The output shows you exactly which features are enabled. Look for InstallState : Installed for Windows-Defender-Features and running services like WinDefend.

Microsoft recommends completely uninstalling Defender on servers without third-party AV. This is the most thorough method and prevents conflicts.

Open PowerShell as Administrator and run the uninstall command:

Uninstall-WindowsFeature -Name Windows-Defender-Features -Restart

If you prefer to restart manually later, use:

Uninstall-WindowsFeature -Name Windows-Defender-Features -Remove

The process removes all Defender components including:

• Windows Defender Antivirus Engine
• Windows Defender GUI
• PowerShell cmdlets for Defender
• All related services and drivers

After restart, verify complete removal:

Get-WindowsFeature -Name Windows-Defender-Features

You should see InstallState : Removed. Also check that Defender services no longer exist:

Get-Service -Name WinDefend -ErrorAction SilentlyContinue

This should return no results or an error indicating the service doesn't exist.

If you can't uninstall Defender or need to disable it across multiple servers via Group Policy, use this method. It disables real-time protection but keeps the service installed.

For local Group Policy, open the editor:

gpedit.msc

Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus

Double-click Turn off Microsoft Defender Antivirus and set it to Enabled. Click OK.

For additional protection disabling, navigate to Real-time Protection subfolder and enable these policies:

• Turn off real-time protection
• Turn off behavior monitoring
• Turn off process scanning

Apply the changes immediately:

gpupdate /force

Verify the policy applied correctly:

Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring

Both values should show True. Also check Windows Security Center shows Defender as disabled.

Registry editing provides the most granular control over Defender settings. Use this method when you need specific configurations or when other methods don't work.

Open Registry Editor as Administrator:

regedit

Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

If the Windows Defender key doesn't exist, create it. Right-click and create these DWORD (32-bit) values:

DisableAntiSpyware = 1
DisableAntiVirus = 1
DisableRealtimeMonitoring = 1

For servers using Microsoft Defender for Endpoint, navigate to:

Create DWORD value:

ForceDefenderPassiveMode = 1

This puts Defender in passive mode, allowing Defender for Endpoint to function while disabling local scanning.

Restart the server to apply registry changes:

Restart-Computer -Force

After restart, verify the changes:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware

For administrators who prefer GUI methods, you can remove Defender through Server Manager. This method works identically to the PowerShell uninstall but uses the graphical interface.

Open Server Manager and click Manage > Remove Roles and Features.

Click Next through the wizard until you reach the Features page. Uncheck Windows Defender Features and all sub-components:

• GUI for Windows Defender
• Windows Defender
• Windows Defender PowerShell Module

Click Next and then Remove. The wizard will prompt for a restart.

After restart, verify removal through PowerShell:

Get-WindowsFeature -Name Windows-Defender-Features

The feature should show InstallState : Removed.

Immediately after disabling Defender, install your alternative antivirus solution. The security gap between disabling Defender and installing replacement protection should be minimized.

Install your chosen enterprise antivirus following the vendor's documentation. Common enterprise solutions include:

• Symantec Endpoint Protection
• CrowdStrike Falcon
• SentinelOne
• Trend Micro Deep Security

After installation, verify the new antivirus is active:

Get-Service | Where-Object {$_.DisplayName -like "*antivirus*" -or $_.DisplayName -like "*endpoint*"}

Test the antivirus functionality by downloading the EICAR test file (safe test virus):

Invoke-WebRequest -Uri "https://www.eicar.org/download/eicar.com.txt" -OutFile "C:\temp\eicar.txt"

Your new antivirus should immediately detect and quarantine this test file. If it doesn't, check the antivirus configuration and ensure real-time protection is enabled.

Configure the antivirus policies according to your organization's security requirements, including:

• Real-time scanning settings
• Scheduled scan times
• Exclusions for server applications
• Reporting and alerting configuration

Perform comprehensive verification to ensure Defender is completely disabled and your server remains secure with the new antivirus solution.

Check that no Defender services are running:

Get-Service | Where-Object {$_.Name -like "*Defender*" -or $_.Name -like "*WinDefend*"}

Verify Defender features are removed:

Get-WindowsFeature | Where-Object {$_.Name -like "*Defender*"}

Check Windows Security Center status:

Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct | Select-Object displayName, productState

The output should show your new antivirus as the active protection, not Windows Defender.

Test system performance to ensure the new antivirus isn't causing conflicts:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 ProcessName, CPU, WorkingSet

Monitor for any unusual CPU or memory usage from antivirus processes.

Finally, check Windows Event Logs for any Defender-related errors:

Get-EventLog -LogName System -Source "*Defender*" -Newest 10 -ErrorAction SilentlyContinue

If this returns no results or only informational events about Defender being disabled, the removal was successful.