# disable-defender.ps1 - Disable Windows Defender on Server 2025
# Run as Administrator

#Requires -RunAsAdministrator

Write-Host "Disabling Windows Defender on Server 2025..." -ForegroundColor Yellow
Write-Host "===============================================" -ForegroundColor Yellow

# 1. Disable Windows Defender Real-Time Protection
Write-Host "`n[1/6] Disabling Real-Time Protection..." -ForegroundColor Cyan
Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
Set-MpPreference -DisablePrivacyMode $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction SilentlyContinue
Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue
Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction SilentlyContinue
Set-MpPreference -MAPSReporting 0 -ErrorAction SilentlyContinue
Set-MpPreference -HighThreatDefaultAction 6 -ErrorAction SilentlyContinue
Set-MpPreference -ModerateThreatDefaultAction 6 -ErrorAction SilentlyContinue
Set-MpPreference -LowThreatDefaultAction 6 -ErrorAction SilentlyContinue
Set-MpPreference -SevereThreatDefaultAction 6 -ErrorAction SilentlyContinue
Write-Host "[OK] Real-Time Protection disabled" -ForegroundColor Green

# 2. Disable Windows Defender via Registry
Write-Host "`n[2/6] Modifying Registry..." -ForegroundColor Cyan

# Disable Windows Defender
$defenderPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
if (!(Test-Path $defenderPath)) {
    New-Item -Path $defenderPath -Force | Out-Null
}
Set-ItemProperty -Path $defenderPath -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $defenderPath -Name "DisableAntiVirus" -Value 1 -Type DWord -Force

# Disable Real-Time Protection via Registry
$realtimePath = "$defenderPath\Real-Time Protection"
if (!(Test-Path $realtimePath)) {
    New-Item -Path $realtimePath -Force | Out-Null
}
Set-ItemProperty -Path $realtimePath -Name "DisableBehaviorMonitoring" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $realtimePath -Name "DisableOnAccessProtection" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $realtimePath -Name "DisableScanOnRealtimeEnable" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $realtimePath -Name "DisableIOAVProtection" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $realtimePath -Name "DisableRealtimeMonitoring" -Value 1 -Type DWord -Force

# Disable Windows Defender Security Center
$secCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center"
if (!(Test-Path $secCenterPath)) {
    New-Item -Path $secCenterPath -Force | Out-Null
}
Set-ItemProperty -Path $secCenterPath -Name "DisableWindowsDefenderSecurityCenter" -Value 1 -Type DWord -Force

# Disable notifications
$notifPath = "$secCenterPath\Notifications"
if (!(Test-Path $notifPath)) {
    New-Item -Path $notifPath -Force | Out-Null
}
Set-ItemProperty -Path $notifPath -Name "DisableNotifications" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $notifPath -Name "DisableEnhancedNotifications" -Value 1 -Type DWord -Force

Write-Host "[OK] Registry modified" -ForegroundColor Green

# 3. Disable Windows Defender Services
Write-Host "`n[3/6] Disabling Services..." -ForegroundColor Cyan

$services = @(
    "WinDefend",                    # Windows Defender Antivirus Service
    "WdNisSvc",                     # Windows Defender Antivirus Network Inspection Service
    "WdNisDrv",                     # Windows Defender Antivirus Network Inspection System Driver
    "WdFilter",                     # Windows Defender Antivirus Mini-Filter Driver
    "WdBoot",                       # Windows Defender Antivirus Boot Driver
    "SecurityHealthService",         # Windows Security Service
    "wscsvc",                       # Security Center
    "Sense"                         # Windows Defender Advanced Threat Protection Service
)

foreach ($service in $services) {
    $svc = Get-Service -Name $service -ErrorAction SilentlyContinue
    if ($svc) {
        Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
        Set-Service -Name $service -StartupType Disabled -ErrorAction SilentlyContinue
        Write-Host "  - Disabled: $service" -ForegroundColor Gray
    }
}
Write-Host "[OK] Services disabled" -ForegroundColor Green

# 4. Disable Windows Defender Firewall
Write-Host "`n[4/6] Disabling Windows Firewall..." -ForegroundColor Cyan
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False -ErrorAction SilentlyContinue
netsh advfirewall set allprofiles state off 2>$null | Out-Null
Write-Host "[OK] Firewall disabled" -ForegroundColor Green

# 5. Remove Windows Defender from startup
Write-Host "`n[5/6] Removing from startup..." -ForegroundColor Cyan
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "WindowsDefender" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "SecurityHealth" -ErrorAction SilentlyContinue

# Disable Windows Defender tasks
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Windows Defender\" -ErrorAction SilentlyContinue | Disable-ScheduledTask -ErrorAction SilentlyContinue
Write-Host "[OK] Startup entries removed" -ForegroundColor Green

# 6. Additional Group Policy settings
Write-Host "`n[6/6] Applying Group Policy settings..." -ForegroundColor Cyan

# Turn off Windows Defender completely
$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
Set-ItemProperty -Path $gpoPath -Name "DisableAntiSpyware" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $gpoPath -Name "ServiceKeepAlive" -Value 0 -Type DWord -Force
Set-ItemProperty -Path $gpoPath -Name "DisableRoutinelyTakingAction" -Value 1 -Type DWord -Force

# Disable cloud-based protection
$spynetPath = "$gpoPath\Spynet"
if (!(Test-Path $spynetPath)) {
    New-Item -Path $spynetPath -Force | Out-Null
}
Set-ItemProperty -Path $spynetPath -Name "SpynetReporting" -Value 0 -Type DWord -Force
Set-ItemProperty -Path $spynetPath -Name "SubmitSamplesConsent" -Value 2 -Type DWord -Force
Set-ItemProperty -Path $spynetPath -Name "DisableBlockAtFirstSeen" -Value 1 -Type DWord -Force

Write-Host "[OK] Group Policy applied" -ForegroundColor Green

# Final status
Write-Host "`n===============================================" -ForegroundColor Green
Write-Host "Windows Defender DISABLED Successfully!" -ForegroundColor Green
Write-Host "===============================================" -ForegroundColor Green
Write-Host "`nChanges applied:" -ForegroundColor Yellow
Write-Host "  - Real-time protection: OFF" -ForegroundColor White
Write-Host "  - Windows Defender services: DISABLED" -ForegroundColor White
Write-Host "  - Windows Firewall: OFF" -ForegroundColor White
Write-Host "  - Security notifications: DISABLED" -ForegroundColor White
Write-Host "  - Cloud protection: OFF" -ForegroundColor White
Write-Host "`n[IMPORTANT] Restart required for full effect" -ForegroundColor Red
Write-Host "Run: Restart-Computer -Force" -ForegroundColor Yellow