设为首页收藏本站客户端
立即注册 | 登录
PCEVA,PC绝对领域,探寻真正的电脑知识
搜索
PCEVA,PC绝对领域,探寻真正的电脑知识»电脑知识论坛 › 娱乐休闲区 › 谈天说地 › GitHub上的禁用和启用WIN10杀毒软件的批处理 ...
返回列表 发新帖
打印 上一主题 下一主题
开启左侧

GitHub上的禁用和启用WIN10杀毒软件的批处理

[复制链接]
跳转到指定楼层
1#
haierccc 发表于 2022-6-4 13:02 | 只看该作者 回帖奖励 |倒序浏览 |阅读模式
点击数：1855|回复数：11
本帖最后由 haierccc 于 2022-6-4 18:30 编辑

如果你想临时禁用 Windows Defender（比如运行于虚拟机中的WIN10。）以提高响应速度，降低音频延迟，可以用此批处理。来自GITHUB。
注意：Windows Defender会发现此脚本并报告威胁，所以需要预先将其关闭，然后管理员权限运行，重启。


关闭Windows Defender.bat
  • @echo OFF
  •         ECHO.
  •         ECHO Please note that Defender can only be disabled in Win10 v2004 and upwards if Tamper Protection is disabled.
  •         ECHO This setting can be found in Window settings (hint: search for 'tamper'). Please do this now and then,
  •         pause
  •         ECHO Disabling Windows Defender - restart required to see change:
  •         REM from: https://pastebin.com/kYCVzZPz
  •         REM Disable Tamper Protection First - on WIn10 vers which allow for this (not from 2004 onwards)
  •         reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
  •         REM To disable System Guard Runtime Monitor Broker
  •         REM reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
  •         REM To disable Windows Defender Security Center include this
  •         REM reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
  •         REM 1 - Disable Real-time protection
  •         reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
  •         reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
  •         REM 0 - Disable Logging
  •         reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
  •         reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
  •         REM Disable WD Tasks
  •         schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
  •         schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
  •         schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
  •         schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
  •         schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
  •         REM Disable WD systray icon
  •         reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
  •         reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
  •         REM Remove WD context menu
  •         reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
  •         reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
  •         reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
  •         REM Disable WD services
  •         reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
  •         reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
  •         reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
  •         reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
  •         reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
  •         REM Disable Security system tray icon
  •         reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t REG_DWORD /d "1" /f
  •         ECHO Windows Defender has (hopefully) been disabled. Please restart your computer to see the change.

开启Windows Defender.bat
  • rem USE AT OWN RISK AS IS WITHOUT WARRANTY OF ANY KIND !!!!!
  • rem https://docs.microsoft.com/en-us ... rence?view=win10-ps
  • rem https://docs.microsoft.com/en-us ... -exploit-protection
  • rem https://github.com/AndyFul/ConfigureDefender
  • rem https://github.com/AndyFul/Hard_Configurator
  • reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
  • reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /t REG_EXPAND_SZ /d "\"%windir%\system32\SecurityHealthSystray.exe\"" /f
  • rem Restore WD shell
  • reg add "HKLM\Software\Classes\*\shellex\ContextMenuHandlers\EPP" /ve /t REG_SZ /d "{09A47860-11B0-4DA5-AFA5-26D86198A780}" /f
  • reg add "HKLM\Software\Classes\Drive\shellex\ContextMenuHandlers\EPP" /ve /t REG_SZ /d "{09A47860-11B0-4DA5-AFA5-26D86198A780}" /f
  • reg add "HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\EPP" /ve /t REG_SZ /d "{09A47860-11B0-4DA5-AFA5-26D86198A780}" /f
  • rem Enable WD services
  • reg add "HKLM\System\CurrentControlSet\Services\BFE" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\MpsSvc" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "2" /f
  • reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "2" /f
  • rem 1 - Enable Logging
  • reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "1" /f
  • reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "1" /f
  • rem Enable WD Tasks
  • schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Enable
  • schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Enable
  • schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Enable
  • schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Enable
  • schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Enable
  • rem CloudExtendedTimeout / 1 - 50 / block a suspicious file for up to 60 seconds (Default is 10)
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpBafsExtendedTimeout" /t REG_DWORD /d "0" /f
  • rem CloudBlockLevel / 0 - Default / 2 - High / 4 - High+ / 6 - Zero tolerance (block all unknown executables)
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpCloudBlockLevel" /t REG_DWORD /d "0" /f
  • rem 1 - Potentially Unwanted Application protection (PUP) is enabled, the applications with unwanted behavior will be blocked at download and install-time
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "1" /f
  • rem Block at First Sight / 0 - Enable / 1 - Disable
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "0" /f
  • rem Cloud-based Protection / 0 - Disable / 1 - Basic / 2 - Advanced
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "1" /f
  • rem Send file samples when further analysis is required / 0 - Always prompt / 1 - Send safe samples automatically / 2 - Never send / 3 - Send all samples automatically
  • reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "1" /f
  • reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "1" /f
  • rem To prevent WD using too much CPU, add this file to the exclusion list:
  • rem C:\Program Files\Windows Defender\MsMpEng.exe
  • reg add "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files\Windows Defender\MsMpEng.exe" /t REG_DWORD /d "0" /f
  • shutdown /r

[color=rgb(51, 102, 153) !important]复制代码

回复

举报

2#
红色狂想 发表于 2022-6-4 16:58 | 只看该作者
都已经手动关闭Windows Defender了，还运行这个脚本干啥？我倒是会在使用系统激活工具之前先建个目录添加到排除列表里，然后再把系统激活工具拷过去
回复

举报

3#
eikeime 发表于 2022-6-4 17:14 | 只看该作者
红色狂想 发表于 2022-6-4 16:58
都已经手动关闭Windows Defender了，还运行这个脚本干啥？我倒是会在使用系统激活工具之前先建个目录添加到 ...

你都 有 nas 了为啥不 vlmcsd？
回复

举报

4#
haierccc  楼主| 发表于 2022-6-4 18:42 | 只看该作者
红色狂想 发表于 2022-6-4 16:58
都已经手动关闭Windows Defender了，还运行这个脚本干啥？我倒是会在使用系统激活工具之前先建个目录添加到 ...

相关服务都停止了，图标也消失了。
而不是留着个红X的图标。
回复

举报

5#
红色狂想 发表于 2022-6-4 21:08 | 只看该作者
eikeime 发表于 2022-6-4 17:14
你都 有 nas 了为啥不 vlmcsd？

不错，这个可以有，等我HP ML310e Gen8 v2弄好了就搞一个
回复

举报

6#
红色狂想 发表于 2022-6-4 21:16 | 只看该作者
haierccc 发表于 2022-6-4 18:42
相关服务都停止了，图标也消失了。
而不是留着个红X的图标。

你是说就像Windows Defender组件卸载了一样，Windows安全中心不会再恶心的提示XXX已被关闭，您将受到安全威胁，建议开启XXX？
回复

举报

7#
haierccc  楼主| 发表于 2022-6-4 21:24 | 只看该作者
红色狂想 发表于 2022-6-4 21:16
你是说就像Windows Defender组件卸载了一样，Windows安全中心不会再恶心的提示XXX已被关闭，您将受到安全 ...

是的                 

回复

举报

8#
尊称 发表于 2022-6-4 23:43 | 只看该作者
请问就你这么搞来搞去，电脑多久趴窝一次？
回复

举报

9#
haierccc  楼主| 发表于 2022-6-5 10:28 | 只看该作者
尊称 发表于 2022-6-4 23:43
请问就你这么搞来搞去，电脑多久趴窝一次？

不在实用的PC上弄，因为根据评测，微软的杀毒软件效果非常好。
只是用于虚拟机，因为是用来做试验的。
回复

举报

10#
尊称 发表于 2022-6-5 12:34 | 只看该作者
haierccc 发表于 2022-6-5 10:28
不在实用的PC上弄，因为根据评测，微软的杀毒软件效果非常好。
只是用于虚拟机，因为是用来做试验的。
...

嗯，那还行。成熟的东西可以拿来分享。
回复

举报

11#
红色狂想 发表于 2022-6-5 14:10 | 只看该作者
haierccc 发表于 2022-6-4 21:24
是的

那还不错，可以给虚拟机里的系统禁用这个，以提升磁盘I/O性能。
回复

举报

12#
StormBolt 发表于 2022-6-5 22:19 | 只看该作者
这个必须禁，注册表折腾了20年了，从没怕过，当年都有书讲95注册表的，现在微软网站也有，你们把这当牛鬼蛇神？
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关于我们ArchiverPCEVA
© 北京绝对领域咨询有限公司 ( 京ICP备13033395号 )

京公网安备 11011502002666号
快速回复 返回顶部