Disable Defender

Turn off Defender, the other Windows security options and BitLocker encryption before spoofing.

Required: Windows Defender, Smart App Control, Memory Integrity and BitLocker drive encryption must all be off before spoofing.

1. Turn Off BitLocker (if enabled)

  1. Save your recovery key first: Open Start, type "Manage BitLocker" and open it. On each encrypted drive, click Back up your recovery key and save it somewhere safe.
  2. Click Turn off BitLocker for the Windows drive and any other encrypted drives.
  3. Wait until decryption fully completes before spoofing - this can take a while. If BitLocker was never enabled, skip this step.

Do not use Suspend-BitLocker for this - it only pauses protection temporarily and does not decrypt the drive.

2. Disable Windows Defender

  1. Open Windows Security -> Virus & threat protection settings -> Manage settings.
  2. Turn off Real-time protection, Cloud-delivered protection, Automatic sample submission and Tamper Protection.
  3. Under App & browser control, set Smart App Control to Off.
  4. Under Device security -> Core isolation details, switch Memory integrity to Off, then restart Windows to apply the change.
  5. Download and run dControl (Defender Control) to disable Defender permanently.
← Previous Page Cleaning Method Next Page → Network Setup