P¤T¤T

使用 PowerShell 啟用功能

雲端保護功能

實時掃描 (一律開啟保護)

潛在的垃圾應用程式保護

Email和封存掃描

管理產品和保護更新

進階威脅和惡意探索防護和預防受控資料夾存取

啟用竄改保護

檢查雲端保護網路連線能力

單選 Microsoft Defender 離線掃描

存成.ps1執行在Powershell中執行

## IMPORTANT!! ##
#################

######
1. Boot in Safe Mode
2. Disable Windows Update
3. Run powershell as admin
4. Set-ExecutionPolicy RemoteSigned
5. Place script in C:\ and run it

Windows 10/11:
C:\Program Files\Windows Defender - This folder contains the executables and other files for Windows Defender.
C:\ProgramData\Microsoft\Windows Defender - This folder contains data and configuration files for Windows Defender
C:\Windows\System32\drivers\wd\ - This folder contains the Windows Defender driver files.
#>

# Check if user is in Virtual Machine, if not exit
$check_vm = $false
Write-Host "Checking if user is in Virtual Machine." -ForegroundColor Yellow
# Get the computer's model
$computerModel = (Get-WmiObject -Class Win32_ComputerSystem).Model
# Check if the model includes the substring "virtual"
if ($computerModel -like "*virtual*") {
Write-Host "This machine is a virtual machine. Will continue." -ForegroundColor Green
$check_vm = $true
}
else {
Write-Host "This machine is not a virtual machine. Will exit NOW." -ForegroundColor Red
Write-Host "[!] Please USE A VIRTUAL MACHINE." -ForegroundColor Red
exit
}

Write-Host "Checking if user is running as TrustedInstaller." -ForegroundColor Yellow
# Check if the script is running as SYSTEM
if (-Not ($(whoami) -eq "nt authority\system")) {
$CheckSystem = $false
# Check if AdvancedRun is installed in current directory
if (!(Test-Path ".\AdvancedRun.exe")) {
# Download AdvancedRun
$url = "https://www.nirsoft.net/utils/advancedrun-x64.zip"
$output = ".\advancedrun-x64.zip"
Invoke-WebRequest -Uri $url -OutFile $output
# Extract the downloaded file
Expand-Archive -Path $output -DestinationPath "." -Force
# Clean up
Remove-Item $output
}
Write-Host "User is not running as TrustedInstaller" -ForegroundColor Yellow
Write-Host "Elevating to TrustedInstaller" -ForegroundColor Yellow
# Launch AdvancedRun.exe and run script as TrustedInstaller to elevate
& ".\AdvancedRun.exe" /EXEFilename "$PSHOME\powershell.exe" /CommandLine $MyInvocation.MyCommand.Path /RunAs 8 /Run
}
else {
$CheckSystem = $true
Write-Host "Already elevated to TrustedInstaller" -ForegroundColor Green
Write-Host "Will continue script now" -ForegroundColor Yellow
}

if ($CheckSystem) {
Write-Host "Disable all functionnalities (TrustedInstaller privilege)" -ForegroundColor Yellow
# Adding exception for all drive letters (C, D, E, F, G, H, I, J, K, L, M, N, O, P, Q, R, S, T, U, V, W, X, Y, Z)
# Define an array of all drive letters
$driveLetters = 67..90 | ForEach-Object { [char]$_ }
# Iterate through the array of drive letters
foreach ($driveLetter in $driveLetters) {
# Add an exception for the current drive letter
Add-MpPreference -ExclusionPath "$($driveLetter):\" -ErrorAction SilentlyContinue
Add-MpPreference -ExclusionProcess "$($driveLetter):\*" -ErrorAction SilentlyContinue
}

# Disable UAC
New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force

# Disable list of engines
Write-Host "Disable Windows Defender engines (Set-MpPreference)" -ForegroundColor Yellow
Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableCatchupFullScan $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableCatchupQuickScan $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableCpuThrottleOnIdleScans $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableDatagramProcessing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableDnsOverTcpParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableDnsParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableEmailScanning $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableGradualRelease $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableHttpParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableInboundConnectionFiltering $true -ErrorAction SilentlyContinue
Set-MpPreference -DisablePrivacyMode $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableRdpParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableRemovableDriveScanning $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableRestorePoint $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableScanningNetworkFiles $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableSshParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableTlsParsing $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableArchiveScanning $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableAutoExclusions $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue
# Set-MpPreference -DisableFtpParing $true -ErrorAction SilentlyContinue
# Set-MpPreference -DisableNetworkProtectionPerfTelemetry $true -ErrorAction SilentlyContinue
# Set-MpPreference -DisableSmtpParsing $true -ErrorAction SilentlyContinue

Write-Host "Set default actions to NoAction (Set-MpPreference)" -ForegroundColor Yellow
# Set default actions to NoAction, so that no alerts are shown, and no actions are taken
# Allow actions would be better in my opinion
Set-MpPreference -LowThreatDefaultAction NoAction -ErrorAction SilentlyContinue
Set-MpPreference -ModerateThreatDefaultAction NoAction -ErrorAction SilentlyContinue
Set-MpPreference -HighThreatDefaultAction NoAction -ErrorAction SilentlyContinue

# Disable Windows Defender.
# editing HKLM:\SOFTWARE\Microsoft\Windows Defender\ requires to be SYSTEM
$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
if (Test-Path $registryPath) {
if (!(Get-ItemProperty -Path $registryPath -Name "DisableAntiSpyware")) {
New-ItemProperty -Path $registryPath -Name "DisableAntiSpyware" -Value 1 -PropertyType DWORD -Force
Write-Host "DisableAntiSpyware property has been created." -ForegroundColor Yellow
Write-Host "Windows Defender has been disabled." -ForegroundColor Green
}
elseif ((Get-ItemProperty -Path $registryPath -Name "DisableAntiSpyware").DisableAntiSpyware -eq 1) {
Write-Host "Windows Defender is already disabled." -ForegroundColor Green
}
else {
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
Write-Host "Windows Defender has been disabled." -ForegroundColor Green

}
}
else {
Write-Host "Your system does not have the Windows Defender registry key." -ForegroundColor Yellow
Write-Host "Windows Defender is already disabled." -ForegroundColor Green
}

# Delete Windows Defender services from registry (HKLM)
$service_list = @( "WdNisSvc" , "WinDefend")
foreach ($svc in $service_list) {
if ($(Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc")) {
if ($(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc").Start -eq 4) {
Write-Host "$svc service has already been deleted" -ForegroundColor Green
}
else {
Write-Host "$svc service has been deleted (Please REBOOT)" -ForegroundColor Green
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name Start -Value 4
}
}
else {
Write-Host "$svc service has already been deleted" -ForegroundColor Green
}
}

# Delete Windows Defender drivers from registry (HKLM)
$driver_list = @("WdnisDrv", "wdboot", "wdfilter")
foreach ($drv in $driver_list) {
if ($("HKLM:\SYSTEM\CurrentControlSet\Services\$drv")) {
if ($(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$drv").Start -eq 4) {
Write-Host "$drv driver has already been disabled" -ForegroundColor Green
}
else {
Write-Host "$drv driver has been disabled (Please REBOOT)" -ForegroundColor Green
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$drv" -Name Start -Value 4
}
}
else {
Write-Host "$drv driver has already been disabled" -ForegroundColor Green
}
}

Write-Host "Deleting Windows Defender (files, services, drivers)" -ForegroundColor Yellow
# Define the paths to the folders to be deleted
if (Test-Path "C:\Windows\System32\drivers\wd\") {
# If the folder exists, output a message indicating that it was not deleted
Write-Host "The C:\Windows\System32\drivers\wd\ is not deleted." -ForegroundColor Yellow
Write-Host "The C:\Windows\System32\drivers\wd\ will be deleting." -ForegroundColor Yellow
Remove-Item "C:\Windows\System32\drivers\wd\" -Recurse -Force
}
else {
# If the folder does not exist, output a message indicating that it was deleted
Write-Host "The C:\Windows\System32\drivers\wd\ has already been deleted." -ForegroundColor Green
}

if (Test-Path "C:\Program Files\Windows Defender") {
Write-Host "The C:\Program Files\Windows Defender is not deleted." -ForegroundColor Yellow
Write-Host "The C:\Program Files\Windows Defender will be deleting." -ForegroundColor Yellow
Remove-Item -Path "C:\Program Files\Windows Defender" -Recurse -Force -ErrorAction SilentlyContinue
}
else {
Write-Host "The C:\Program Files\Windows Defender has already been deleted." -ForegroundColor Green
}

if (Test-Path "C:\ProgramData\Microsoft\Windows Defender") {
Write-Host "The C:\ProgramData\Microsoft\Windows Defender is not deleted." -ForegroundColor Yellow
Write-Host "The C:\ProgramData\Microsoft\Windows Defender will be deleting." -ForegroundColor Yellow
Remove-Item -Path "C:\ProgramData\Microsoft\Windows Defender" -Recurse -Force -ErrorAction SilentlyContinue
}
else {
Write-Host "The C:\ProgramData\Microsoft\Windows Defender has already been deleted." -ForegroundColor Green
}

# Disable Windows Update Service
Write-Host "Disabling Windows Update Service" -ForegroundColor Yellow
# Get the Windows Update service
$wuauserv = Get-Service -Name "wuauserv"
# Stop the service
Stop-Service $wuauserv
# Set the service startup type to disabled
Set-Service -Name "wuauserv" -StartupType Disabled
# Confirm that the service has been disabled
$wuauserv | Select-Object -Property Name, StartupType, Status
if ($wuauserv.StartType -eq "Disabled" -and $wuauserv.Status -eq "Stopped") {
Write-Host "Windows Update has been disabled." -ForegroundColor Green
}
else {
Write-Host "Windows Update has not been disabled." -ForegroundColor Red
}

# Set the Windows Update service to disabled via Registry
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv" -Name "Start" -Value 4
# Confirm the change by reading the Start value via Registry
$startValue = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv").Start
if ($startValue -eq 4) {
Write-Host "The Windows Update service has been disabled." -ForegroundColor Green
}
else {
Write-Host "The Windows Update service has not been disabled. Please check the registry." -ForegroundColor Yellow
}

# Check list of service running or not
Write-Host "Check disabled engines (Get-MpPreference)" -ForegroundColor Yellow
Get-MpPreference | Format-List disable*

Write-Host ""
Write-Host "Some engines might return False, ignore" -ForegroundColor Yellow

# Check if Windows Defender service running or not
if ($(GET-Service -Name WinDefend).Status -eq "Still Running") {
Write-Host "Windows Defender Service is still running (Please REBOOT)" -ForegroundColor Yellow
}
else {
Write-Host "Windows Defender Service is not running" -ForegroundColor Green
}
Write-Host ""
Write-Host "Please REBOOT your system to after completing the whole process. Thank you." -ForegroundColor Green
Write-Host ""
Read-Host -Prompt "Press Enter to close the terminal"
}

或存成.ps2執行在Powershell中執行

if(-Not $($(whoami) -eq "nt authority\system")) {
    $IsSystem = $false

    # Elevate to admin (needed when called after reboot)
    if (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator')) {
        Write-Host "    [i] Elevate to Administrator"
        $CommandLine = "-ExecutionPolicy Bypass `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments
        Start-Process -FilePath PowerShell.exe -Verb Runas -ArgumentList $CommandLine
        Exit
    }

    # Elevate to SYSTEM if psexec is available
    $psexec_path = $(Get-Command PsExec -ErrorAction 'ignore').Source 
    if($psexec_path) {
        Write-Host "    [i] Elevate to SYSTEM"
        $CommandLine = " -i -s powershell.exe -ExecutionPolicy Bypass `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments 
        Start-Process -WindowStyle Hidden -FilePath $psexec_path -ArgumentList $CommandLine
        exit
    } else {
        Write-Host "    [i] PsExec not found, will continue as Administrator"
    }

} else {
    $IsSystem = $true
}
67..90|foreach-object{
    $drive = [char]$_
    Add-MpPreference -ExclusionPath "$($drive):\" -ErrorAction SilentlyContinue
    Add-MpPreference -ExclusionProcess "$($drive):\*" -ErrorAction SilentlyContinue
}

Write-Host "    [+] Disable scanning engines (Set-MpPreference)"

Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue
Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue

Write-Host "    [+] Set default actions to Allow (Set-MpPreference)"

Set-MpPreference -LowThreatDefaultAction Allow -ErrorAction SilentlyContinue
Set-MpPreference -ModerateThreatDefaultAction Allow -ErrorAction SilentlyContinue
Set-MpPreference -HighThreatDefaultAction Allow -ErrorAction SilentlyContinue
$need_reboot = $false

# WdNisSvc Network Inspection Service 
# WinDefend Antivirus Service
# Sense : Advanced Protection Service

$svc_list = @("WdNisSvc", "WinDefend", "Sense")
foreach($svc in $svc_list) {
    if($(Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc")) {
        if( $(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc").Start -eq 4) {
            Write-Host "        [i] Service $svc already disabled"
        } else {
            Write-Host "        [i] Disable service $svc (next reboot)"
            Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name Start -Value 4
            $need_reboot = $true
        }
    } else {
        Write-Host "        [i] Service $svc already deleted"
    }
}

Write-Host "    [+] Disable drivers"

# WdnisDrv : Network Inspection System Driver
# wdfilter : Mini-Filter Driver
# wdboot : Boot Driver

$drv_list = @("WdnisDrv", "wdfilter", "wdboot")
foreach($drv in $drv_list) {
    if($(Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\$drv")) {
        if( $(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$drv").Start -eq 4) {
            Write-Host "        [i] Driver $drv already disabled"
        } else {
            Write-Host "        [i] Disable driver $drv (next reboot)"
            Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$drv" -Name Start -Value 4
            $need_reboot = $true
        }
    } else {
        Write-Host "        [i] Driver $drv already deleted"
    }
}

# Check if service running or not
if($(GET-Service -Name WinDefend).Status -eq "Running") {   
    Write-Host "    [+] WinDefend Service still running (reboot required)"
    $need_reboot = $true
} else {
    Write-Host "    [+] WinDefend Service not running"
}
$link_reboot = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\disable-defender.lnk"
Remove-Item -Force "$link_reboot" -ErrorAction 'ignore' # Remove the link (only execute once after reboot)

if($need_reboot) {
    Write-Host "    [+] This script will be started again after reboot." -BackgroundColor DarkRed -ForegroundColor White

    $powershell_path = '"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"'
    $cmdargs = "-ExecutionPolicy Bypass `"" + $MyInvocation.MyCommand.Path + "`" " + $MyInvocation.UnboundArguments

    $res = New-Item $(Split-Path -Path $link_reboot -Parent) -ItemType Directory -Force
    $WshShell = New-Object -comObject WScript.Shell
    $shortcut = $WshShell.CreateShortcut($link_reboot)
    $shortcut.TargetPath = $powershell_path
    $shortcut.Arguments = $cmdargs
    $shortcut.WorkingDirectory = "$(Split-Path -Path $PSScriptRoot -Parent)"
    $shortcut.Save()
} else {
    if($IsSystem) {

        # Configure the Defender registry to disable it (and the TamperProtection)
        # editing HKLM:\SOFTWARE\Microsoft\Windows Defender\ requires to be SYSTEM

        Write-Host "    [+] Disable all functionnalities with registry keys (SYSTEM privilege)"

        # Cloud-delivered protection:
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SpyNetReporting -Value 0
        # Automatic Sample submission
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -Name SubmitSamplesConsent -Value 0
        # Tamper protection
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name TamperProtection -Value 4

        # Disable in registry
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
        Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1

    } else {
        Write-Host "    [W] (Optional) Cannot configure registry (not SYSTEM)"
    }


    if($MyInvocation.UnboundArguments -And $($MyInvocation.UnboundArguments.tolower().Contains("-delete"))) {

        # Delete Defender files

        function Delete-Show-Error {
            $path_exists = Test-Path $args[0]
            if($path_exists) {
                Remove-Item -Recurse -Force -Path $args[0]
            } else {
                Write-Host "    [i] $($args[0]) already deleted"
            }
        }

        Write-Host ""
        Write-Host "[+] Delete Windows Defender (files, services, drivers)"

        # Delete files
        Delete-Show-Error "C:\ProgramData\Windows\Windows Defender\"
        Delete-Show-Error "C:\ProgramData\Windows\Windows Defender Advanced Threat Protection\"

        # Delete drivers
        Delete-Show-Error "C:\Windows\System32\drivers\wd\"

        # Delete service registry entries
        foreach($svc in $svc_list) {
            Delete-Show-Error "HKLM:\SYSTEM\CurrentControlSet\Services\$svc"
        }

        # Delete drivers registry entries
        foreach($drv in $drv_list) {
            Delete-Show-Error "HKLM:\SYSTEM\CurrentControlSet\Services\$drv"
        }
    }
}
Write-Host "Script Finished" -foregroundcolor Yellow

方法七

小工具 https://www.sordum.org/9480/defender-control-v2-1/