Tech Support Guy banner
Status
Not open for further replies.

Unable to set new owner on Windows Defender Registry key

16K views 15 replies 8 participants last post by  Cookiegal  
#1 ·
I am administrator on my own PC, so there is no issue over permissions. I was trying to disable Windows Defender realtime scanning due to the inordinate amount of resources it uses. Yes, I am aware of the consequences.

I get the following when I try to manage Real-Time protection:

Image

So after reading some articles I understand there are some registry keys, namely:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

I have tried to change DisableAntiVirus key, current at 0 and told I "Cannot edit DisableAntiVirus: Error writing the new value's new contents".

I have tired disabling the service in GPEDIT but can't make any changes.

I have tried the route in this topic:
Can't view or delete a registry key or take...

Namely running:
c:\Progs\nirsoft_package_enc_1.23.69\SysinternalsSuite\PsExec64 -i -d -s c:\Windows\regedit.exe


But I still can't change the key, or it's owner.




Image


Any suggestions would be appreciated
 
#2 ·
due to the inordinate amount of resources it uses.
Why not try to find out why it is consuming an inordinate amount of resources instead? Typically Defender is fairly light on resource utilization. If yours is using an inordinate amount, it would be a good idea to determine why as that is not normal.

Below is mine. You can see it is only using .1% of my CPU and just 223MB of RAM of the total 7.2GB of RAM currently in use.

Image


What do you seen in TM?
 
  • Like
Reactions: 2twenty2
Save
#3 ·
I can assure you, that if you proceed with your attempts to change permissions for aspects of Windows Security including the principle question of your post, you have the potential to cause MANY problerms
Aspects of the windows security and Microsoft Defender and many other aspects of the various options within Windows Security are controlled by the system and the ONLY Safe and reliable changes that can be made are those available in settings - security etc.

IF YOUR opening post
I get the following when I try to manage Real-Time protection:
shown immediately below that line is
FROM YOUR ACTUAL COMPUTER, then you will note it is already shown as turned OFF
=======================================================================

The cause of the message
This setting is managed by your Administrator

is usually
1. You have a third party Anti Virus system installed
Depending on what this is, and what entries that system makes to your computer it MAY produce that message
DO YOU HAVE some third party antivirus installed please

2. You have used some type of third party system management app that often includes registry cleaners and offers options to turn off (this and that) whilst gaming for example to make the system into a flying machine - or words to that effect

3.You have acquired unwanted software - that has made the changes to turn it off.

======================
Either way you are trying to go along an unsafe and incorrect route., when you reply with the answer to - 1

I can offer further guidance.

Finally regarding your attempted changes to the regsitry and permissions, they appear from what you have said, not to have worked.
Therefore if that is correct no damage has been done.
I advice that no more changes are attempted without the precaution of at the very least a restore point.
==========================================

The actual key you need to check FIRST is

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
tell me please what entries are in the main pane for disable anti spyware
IF ANY
 
  • Helpful
Reactions: 2twenty2
Save
#9 ·
First of all, may I thank you for your time here.

I can assure you, that if you proceed with your attempts to change permissions for aspects of Windows Security including the principle question of your post, you have the potential to cause MANY problerms
Aspects of the windows security and Microsoft Defender and many other aspects of the various options within Windows Security are controlled by the system and the ONLY Safe and reliable changes that can be made are those available in settings - security etc.

IF YOUR opening post

shown immediately below that line is
FROM YOUR ACTUAL COMPUTER, then you will note it is already shown as turned OFF
=======================================================================

The cause of the message
This setting is managed by your Administrator

is usually
1. You have a third party Anti Virus system installed
Depending on what this is, and what entries that system makes to your computer it MAY produce that message
DO YOU HAVE some third party antivirus installed please


No, this was turned off through a registry change a while ago.
There is no other real-time virus check. I do an occasional manual scan, though recently Windows makes it's own scan without seeming any way of changing how often this takes place.

2. You have used some type of third party system management app that often includes registry cleaners and offers options to turn off (this and that) whilst gaming for example to make the system into a flying machine - or words to that effect

3.You have acquired unwanted software - that has made the changes to turn it off.
No, to both of the above. I generally run known applications that have history. I also use VurusTotal to check anything I might run on anything else or of unknown provenance. I also supply the actual executable, as I am aware that some URLs provide different executables to VirusTotal if enter URL of the executable.

======================
Either way you are trying to go along an unsafe and incorrect route., when you reply with the answer to - 1
I can offer further guidance.
I agree there is risk. But I am more at risk when Microsoft do their best to stop me doing what I choose. A recent example was the forceable redirection of Internet Explorer to MS Edge after an update. It is the only browser that can access a CCTV system we have and is not used for anything else. Thankfully there is a work-around. Yes, I know it is insecure.

Finally regarding your attempted changes to the regsitry and permissions, they appear from what you have said, not to have worked.
Therefore if that is correct no damage has been done.
That is debatable, where the damage has already been done and cannot be corrected.

I advice that no more changes are attempted without the precaution of at the very least a restore point.
==========================================
Excellent advice. I think it is useful to add, that the OS has been running for years without a re-install.

The actual key you need to check FIRST is

  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
tell me please what entries are in the main pane for disable anti spyware
IF ANY
I suspect this is what you want to see?

Image


Many thanks again.
 
#4 · (Edited)
Windows Defender has self protection capabilities to stop malware from disabling it.

You would have to be more creative than just trying to take ownership. I have seen malware successfully disable Windows Defender, but as to how, you would have a ask a malware writer. Good luck to your travels to the dark web.

If you find Defender so intrusive, why not install a third party antivirus. There are free ones which are quite good. Like Kaspersky Free, AVG Free, Avast Free. And their detection rates are higher than Defender.

Or maybe you have aging hardware; maybe that's why you find Defender taking up resources. In that case, upgrade your hard drive to a SSD. (solid state drive) Your pc will be zipping along again, guaranteed. $49/500 GB at newegg.com.
 
#10 ·
Windows Defender has self protection capabilities to stop malware from disabling it.

You would have to be more creative than just trying to take ownership. I have seen malware successfully disable Windows Defender, but as to how, you would have a ask a malware writer. Good luck to your travels to the dark web.

If you find Defender so intrusive, why not install a third party antivirus. There are free ones which are quite good. Like Kaspersky Free, AVG Free, Avast Free. And their detection rates are higher than Defender.
Good points, and I have no intention of entering the dark web.

I would like one that I can turn on and off as I choose, not one that can only be temporarily turned off. To me that's the worst of both worlds.

Or maybe you have aging hardware; maybe that's why you find Defender taking up resources. In that case, upgrade your hard drive to a SSD. (solid state drive) Your pc will be zipping along again, guaranteed. $49/500 GB at newegg.com.
It's an i7 with an SSD as the primary disk.
 
#5 ·
It should be noted that malware that successfully disabled Defender (AND other anti-malware solutions too) typically was successful only because the user (ALWAYS the weakest link in security) failed to keep the OS or their security current and then allowed the bad guy in by clicking on an unsolicited link. Or they failed to use strong passwords or wifi passphrases, or they allowed less disciplined users physical access to their systems with an admin account.

See this 2020 BC article, Malware can no longer disable Microsoft Defender via the Registry (bleepingcomputer.com).

Point being, it is extremely difficult for any bad guys to disable your anti-malware solution (regardless which one) on a current W10/W11 system without the user actively compromising security in the first place.
 
Save
#6 · (Edited)
@Mikexx Sorry if I quoted you something that belongs in the distant past, didn't mean to send you on a wild goose chase into the dark web. A hacker told me to watch out for a Defender icon showing a red x, and he said that's the first thing they do once they're inside a machine - turn off the antivirus. And he demo'd it. I opened a port for him and bam, he was inside. the port was related to a security software I was using. I have no reason to doubt him, but that was a while ago.
 
#7 ·
If you want to completely remove Windows Defender and replace it with a third-party app then you can. Defender, not wanting to be removed, will flag the software below as malware. If you don't trust a program that a random someone posts on the Internet (and why should you?) then you can do everything manually.
  1. Create a Restore Point
  2. Do everything while in Safe Mode
  3. Anything you mess up is your own fault
 
#11 ·
If you want to completely remove Windows Defender and replace it with a third-party app then you can. Defender, not wanting to be removed, will flag the software below as malware. If you don't trust a program that a random someone posts on the Internet (and why should you?) then you can do everything manually.
  1. Create a Restore Point
  2. Do everything while in Safe Mode
  3. Anything you mess up is your own fault
An open sourced application has a fighting chance of not having malware, though I would want to build the executable rather than relying on on a supplied one.

Many thanks for the video. It has given me some thought to the process. The GUI looks very attractive, it's a shame that Windows doesn't give you the same control.
 
#8 ·
In my humble opinion, whilst everyone is perfectly entitled to suggest anything they wish, such methods as this should come with a
HEALTH WARNING in large capital letters.

Windows security and the Microsoft Defender are totally integrated into Windows 10 system.

Anything can be found on a web search, as I am sure this one was.
 
Save
#12 ·
I was trying to disable Windows Defender realtime scanning due to the inordinate amount of resources it uses. Yes, I am aware of the consequences.
I may be missing the vital point of what you are trying to do.
However if it is as you state above, then you have already disabled REALTIME scanning, as shown on your image posted on your post 9

That value set at 1 is why real time monitoring is OFF as shown in your first post and as I commented in my post 3.

Even, although you have turned off REAL TIME proection - monitoring Microsoft Defender, which is onl;y one part of Windows Secuirty, will still make periodic scans, as you have found out.

What is not often realised is that attempting to make changes in the registry, such as you have done - often results in an increased use of resources by Windows Security as a whole, and Microsoft Defender as part of that.

Without going into a long complicated and technical explanation - one simple example is that Defender, records its scans and on its self initiated scans, it only scans files that have been changed since its last scan.

However if settings are changed or even as little as temp files deleted in the wrong manner, or indeed some third party defrag used, this often results in that record being deleted or moved to the wrong place on a defrag and the result is that each scan by defender is effectively a full scan, not merely a scan of changed files.



That ALL SAID, what you do is of course completely your choice

The answer that my colleague Digerati provided
Why not try to find out why it is consuming an inordinate amount of resources instead? Typically Defender is fairly light on resource utilization. If yours is using an inordinate amount, it would be a good idea to determine why as that is not normal.
was first class advice.

HOWEVER that of course only applies IF you were willing to leave all settings for security as MIcrosoft intended.

Good luck with it - I have nothing further to advise regarding how you should proceed.


.
 
Save
Status
Not open for further replies.
You have insufficient privileges to reply here.