Disabling Microsoft Antimalware service

Question

I can't disable the Microsoft Antimalware service (MsMpSvc/MsMpEng.exe). I tried using services.msc, but the Startup Type drop-down is grayed out and I can't change it to Disabled nor stop the service. I also tried msconfig, but when I click Apply, the service gets enabled again. I even tried net stop msmpsvc and got system error 5 (access denied).

Any suggestions?

Answer 1

Just in case someone will face the same questions on Windows 8/8.1 - there is now build-in option to stop both Windows Defender-related services:

• Windows Defender Network Inspection Service and
• Windows Defender Service:

Answer 2

Another way to get around the protection:

1. Go to options and
2. Find where it says "Exclude files and folders"
3. Then just add the "C:\" drive.

This way even if you can't disable it outright, it can't scan your computer at all.

Also do this for both Windows Defender and Microsoft Essentials.

Answer 3

The best way to disable the Defender is to run regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender, take ownership of this registry key (inside regedit.exe or via the 3rd party tool RegOwnershipEx) and set the values DisableAntiSpyware and DisableAntiVirus both to 1.

^{click to enlarge}

Note, if you only see 1 of the values, change this one.

Answer 4

OK appears the UI has changed, at least with windows 10 "creators update":

Settings app -> "Update & Security" -> Windows Defender -> "Open Windows Defender Security Center" -> "Virus & Threat protection" -> "Virus & Thread Protection settings" (button) -> "Real-time protection" slide the selector button to "off"

Now MsMpEng.exe isn't using 100% cpu and system is faster (though unprotected).

For a disk intensive build my build times went from 8m33s to 1m49s whoa!

Answer 5

Windows Defender/Microsoft Security Essentials is very tightly knit into the operating system in order to provide more security. It's best to disable it through the natural means than trying to cut it out piece by piece.

Go to your control panel, and select the entry for your Microsoft Antivirus. It might be listed as "Windows Defender" depending on your update history. Look in the 'settings' section in the Antivirus GUI for a "disable"

Depending on how updated your Windows Defender/MSE is, and how updated you received the program, these steps may vary, but the general idea is the same: disable it the way they provided you, not by trying to be crafty.

You'll find that many antiviruses will inject modifications into discrete crevasses of your operating system in the name of security.
Good rules of thumb to remember are to

1. Always install, uninstall, disable, and so on, the way the manufacturer intended. If you fail to do so, and you don't know exactly what you're doing, start over. (e.g. Reinstall, then uninstall)
2. Search for tools which allow you to clean up after failed operations. For example, Symantec provides the Norton Removal Tool, which will scan for leftovers of a damaged [un]installation and remove them.

Answer 6

If you just want to shut it down temporarily:

1) Open the search bar (right side of screen)

2) Search SETTINGS and type in ADVANCED

3) Select "Advanced startup options"

4) Scroll to the bottom and select "Restart now" (computer will restart and bring you to the Advanced Startup options menu.)

5) Select "Troubleshoot" at the Advanced Startup options menu.

6) Select the "Startup settings" option.

7) Select "Disable early-launch anti-malware protection" (option #8)

8) Select the restart button and you'll be brought to windows.

Do whatever you want to do, and the next time you restart your computer it will be enabled automatically again.

Answer 7

On Windows 7, this MsMpEng.exe service is part of Microsoft Security Essentials (find it under Start > All Programs). You can disable its real-time protection, in the Settings tab:

However, this might not disable the MsMpEng.exe service from running, so you'd probably have to uninstall Microsoft Security Essentials for this matter: