Microsoft Defender Disabled

Policy values that turn Defender protection off, and the tamper protection state.

Use it to spot a policy telling Defender to stop real-time scanning, and check whether tamper protection blocked it.

SOFTWARE
Defence Evasion

What It Is

This key, in the SOFTWARE hive, holds the policy settings for Microsoft Defender Antivirus, the Windows application that blocks, removes and quarantines malicious software. A policy is a setting an administrator manages centrally, through Group Policy, Configuration Manager or Defender for Endpoint security settings management. Policy settings take precedence over those made on the machine itself with PowerShell or WMI. When tamper protection is on, Defender ignores changes to the settings it protects.

What It Proves

A policy value such as DisableRealtimeMonitoring or DisableAntiSpyware set to 1 records an attempt to turn protection off. Whether it took effect depends on tamper protection, which blocks these edits when it is on.

What It Does Not Prove

On current Defender platforms DisableAntiSpyware is ignored, so a 1 there shows intent, not success. The tamper protection state is held by the service and is best confirmed with Defender events.

Where It Lives

Microsoft Defender Disabled lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Policies\Microsoft\Windows Defender

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Microsoft Defender Disabled, each with what it tells you
Registry Value	What It Tells You
`DisableAntiSpyware` `REG_DWORD0x00000001 (1)`	The setting is a policy attempt to turn Defender off. Devices onboarded to Defender for Endpoint ignore it, so it marks intent. Check Defender events 5007 and 5010.
`Real-Time Protection\DisableRealtimeMonitoring` `REG_DWORD0x00000001 (1)`	A policy told real-time scanning to stop. Defender event 5001 shows it took effect, and event 5013 shows tamper protection blocked it.
`Real-Time Protection` `SubkeyLast write 12 Oct 2026 10:04 UTC`	The Real-Time Protection policy last changed at 12 Oct 2026 10:04 UTC, two minutes before the Temp binary. Look for event 5001 or 5013 in the Microsoft-Windows-Windows Defender/Operational log at that minute.
`SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection` `REG_DWORD0x00000004 (4)`	Microsoft does not document this number, so it only hints tamper protection may be off. Check IsTamperProtected in Get-MpComputerStatus or the Defender portal.

How to Read It

Check DisableAntiSpyware under Policies\Microsoft\Windows Defender and the values in its Real-Time Protection subkey. Read the TamperProtection value under Microsoft\Windows Defender\Features to see whether edits were being blocked. To put it right, clear the policy values, confirm real-time protection is on, and keep tamper protection enabled.

When Windows Writes It: When Group Policy, a management tool, or an attacker with admin rights writes a Defender policy value.
Which Windows Versions: Windows 10, 11 and Server with Microsoft Defender Antivirus
Tools That Parse It: Registry Explorer, RECmd, RegRipper

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes, but a hit shows an attempt, not that protection went off, because tamper protection blocks or ignores it. DeviceEvents with ActionType TamperingAttempt is the second check.

KQLDefender XDR, Advanced hunting

// Defender protection turned off through policyDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\Windows Defender"| where RegistryValueName startswith "Disable"| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Microsoft Defender Disabled shows.

Real-Time Protection Disabled, Microsoft Defender Event 5001Not in the RegistryRecords that real-time protection actually went off, and when.
Defender Setting Changed, Microsoft Defender Event 5007Not in the RegistryRecords each Defender setting change with its old and new values, and when.
Tamper Protection Blocked a Change, Microsoft Defender Event 5013Not in the RegistryRecords tamper protection blocking the change, so it never took effect.

Sources

The facts on this page come from these public pages, which say more on each point.