Disable MsMpSvc from command line

Question

Quite simply I'm looking for a way to disable Microsoft's security essentials service from the command line, you used to be able to run the command (as admin)

net stop MsMpSvc

but that was somehow rendered useless after an update (err 5:access denied) .

I then even ran a shell as 'SYSTEM' user (which is the user that MsMpSvc runs under) but alas still get an access denied message using the commands taskkill (for msmpeng.exe) and stop-service with the -force argument.

Is there a way around this?

_{Yes I'm aware of the security implications of this}

Answer 1

The Microsoft Antimalware service is protected in various places against being disabled, because this is an attack vector used by certain types of malware. Unfortunately when we have cause to legitimately disable the service, we are then unable to do so.

Answer 2

Override the permissions with SubInACL, set the service to manual in the registry, then reboot.

There is no point in killing a service that is designed to not be killed, you disable its boot entry instead.

Answer 3

Try using the sc command to configure the state of the service:

sc config MsMpSvc start=disabled

Then if the service is stopped you can use net stop or sc stop to stop the service. It depends on your version of Windows, but you need to ensure that the command prompt was opened with Administrative access:

http://technet.microsoft.com/en-us/library/cc947813%28v=ws.10%29.aspx

Answer 4

Open microsoft security essentials

go to settings

press on the tab called "real-time protection"

untick the checkmark box to disable real-time protection

that's it.

Answer 5

Disabling MSE does nothing to stop MsMpEng from taking top priority right at start-up and maxing out your computer's CPU and RAM until it's damn good and ready. You cannot change the priority. You cannot temporarily disable it while some other CPU-sucking Microsoft application [e.g. the virus known as Windows Update] is running.

Whoreson.