DefenderToggle.bat

@echo off
title Windows Defender Toggle v3
chcp 65001 >nul 2>&1
color 0A

:: ===== ADMIN CHECK - Auto Elevation =====
net session >nul 2>&1
if %errorLevel% neq 0 (
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

:MENU
cls
echo.
echo   ╔════════════════════════════════════════════╗
echo   ║       WINDOWS DEFENDER TOGGLE v3           ║
echo   ╠════════════════════════════════════════════╣
echo   ║                                            ║
echo   ║  [1] FULLY DISABLE  (Requires reboot)     ║
echo   ║  [2] FULLY ENABLE   (Requires reboot)     ║
echo   ║  [3] Disable Tamper Protection             ║
echo   ║  [4] Status Report                         ║
echo   ║  [5] Exit                                  ║
echo   ║                                            ║
echo   ╚════════════════════════════════════════════╝
echo.

powershell -NoProfile -Command ^
    "$s = Get-MpComputerStatus; " ^
    "Write-Host '   Real-Time Protection : ' -NoNewline; " ^
    "if ($s.RealTimeProtectionEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host '   Tamper Protection    : ' -NoNewline; " ^
    "if ($s.IsTamperProtected) { Write-Host 'ON - USE MENU 3 FIRST!' -ForegroundColor Yellow } else { Write-Host 'OFF' -ForegroundColor Green }; " ^
    "Write-Host '   Antivirus Service    : ' -NoNewline; " ^
    "if ($s.AntivirusEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red };"
echo.
set /p choice="   Your choice (1-5): "

if "%choice%"=="1" goto DISABLE
if "%choice%"=="2" goto ENABLE
if "%choice%"=="3" goto TAMPER
if "%choice%"=="4" goto STATUS
if "%choice%"=="5" exit /b 0
goto MENU

:TAMPER
cls
echo.
echo   TAMPER PROTECTION DISABLE GUIDE
echo   ════════════════════════════════════════════
echo.
echo   1. Scroll down on the opened settings page
echo   2. Find "Tamper Protection"
echo   3. Toggle it OFF
echo   4. Click YES on the UAC prompt
echo   5. Come back here and press ENTER
echo.
echo   ════════════════════════════════════════════
echo.
start "" "windowsdefender://threatsettings"
echo   Settings page opened. Disable Tamper Protection, then press ENTER.
pause
goto MENU

:DISABLE
cls
echo.
echo   DISABLING DEFENDER...
echo   ════════════════════════════════════════════
echo.

:: Tamper Protection check
powershell -NoProfile -Command ^
    "if ((Get-MpComputerStatus).IsTamperProtected) { " ^
    "  Write-Host '   [X] TAMPER PROTECTION IS ON!' -ForegroundColor Red; " ^
    "  Write-Host '   [!] Disable it first using menu 3!' -ForegroundColor Yellow; " ^
    "  exit 1 " ^
    "}"
if %errorLevel% neq 0 (
    echo.
    pause
    goto MENU
)

echo   [1/5] Disabling all protections via PowerShell...
powershell -NoProfile -Command ^
    "Set-MpPreference -DisableRealtimeMonitoring $true; " ^
    "Set-MpPreference -DisableIOAVProtection $true; " ^
    "Set-MpPreference -DisableBehaviorMonitoring $true; " ^
    "Set-MpPreference -DisableBlockAtFirstSeen $true; " ^
    "Set-MpPreference -DisableScriptScanning $true; " ^
    "Write-Host '         Done.' -ForegroundColor Green"

echo   [2/5] Writing Group Policy registry keys...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f >nul 2>&1
echo         Done.

echo   [3/5] Disabling Defender service...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 4 /f >nul 2>&1
echo         Done.

echo   [4/5] Disabling cloud protection...
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v HideSystray /t REG_DWORD /d 1 /f >nul 2>&1
echo         Done.

echo   [5/5] Disabling scheduled tasks...
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable >nul 2>&1
echo         Done.

echo.
echo   ════════════════════════════════════════════
powershell -NoProfile -Command "Write-Host '   [OK] DEFENDER FULLY DISABLED!' -ForegroundColor Green"
echo   A reboot is required for all changes.
echo   ════════════════════════════════════════════
echo.
set /p reboot="   Reboot now? (Y/N): "
if /i "%reboot%"=="Y" shutdown /r /t 5 /c "Defender Toggle - Rebooting..."
goto MENU

:ENABLE
cls
echo.
echo   ENABLING DEFENDER...
echo   ════════════════════════════════════════════
echo.

echo   [1/5] Enabling all protections via PowerShell...
powershell -NoProfile -Command ^
    "Set-MpPreference -DisableRealtimeMonitoring $false; " ^
    "Set-MpPreference -DisableIOAVProtection $false; " ^
    "Set-MpPreference -DisableBehaviorMonitoring $false; " ^
    "Set-MpPreference -DisableBlockAtFirstSeen $false; " ^
    "Set-MpPreference -DisableScriptScanning $false; " ^
    "Write-Host '         Done.' -ForegroundColor Green"

echo   [2/5] Removing Group Policy overrides...
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /f >nul 2>&1
echo         Done.

echo   [3/5] Enabling Defender service...
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 2 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v Start /t REG_DWORD /d 2 /f >nul 2>&1
echo         Done.

echo   [4/5] Enabling cloud protection...
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /f >nul 2>&1
echo         Done.

echo   [5/5] Enabling scheduled tasks...
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Enable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Enable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Enable >nul 2>&1
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Enable >nul 2>&1
echo         Done.

echo.
echo   ════════════════════════════════════════════
powershell -NoProfile -Command "Write-Host '   [OK] DEFENDER FULLY ENABLED!' -ForegroundColor Green"
echo   A reboot is required for all changes.
echo   ════════════════════════════════════════════
echo.
set /p reboot="   Reboot now? (Y/N): "
if /i "%reboot%"=="Y" shutdown /r /t 5 /c "Defender Toggle - Rebooting..."
goto MENU

:STATUS
cls
echo.
echo   DETAILED STATUS REPORT
echo   ════════════════════════════════════════════
echo.
powershell -NoProfile -Command ^
    "$s = Get-MpComputerStatus; " ^
    "Write-Host '   --- Defender Status ---' -ForegroundColor Cyan; " ^
    "Write-Host '   Real-Time Protection  : ' -NoNewline; " ^
    "if ($s.RealTimeProtectionEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host '   Tamper Protection     : ' -NoNewline; " ^
    "if ($s.IsTamperProtected) { Write-Host 'ON' -ForegroundColor Yellow } else { Write-Host 'OFF' -ForegroundColor Green }; " ^
    "Write-Host '   Antivirus             : ' -NoNewline; " ^
    "if ($s.AntivirusEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host '   Anti-Spyware          : ' -NoNewline; " ^
    "if ($s.AntispywareEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host '   Behavior Monitoring   : ' -NoNewline; " ^
    "if ($s.BehaviorMonitorEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host '   IOAV Protection       : ' -NoNewline; " ^
    "if ($s.IoavProtectionEnabled) { Write-Host 'ON' -ForegroundColor Green } else { Write-Host 'OFF' -ForegroundColor Red }; " ^
    "Write-Host ''; " ^
    "Write-Host '   --- Registry Status ---' -ForegroundColor Cyan; " ^
    "Write-Host '   DisableRealtimeMonitor : ' -NoNewline; " ^
    "$v1 = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name DisableRealtimeMonitoring -EA SilentlyContinue).DisableRealtimeMonitoring; " ^
    "if ($v1 -eq 1) { Write-Host 'DISABLED' -ForegroundColor Red } else { Write-Host 'Not set / Enabled' -ForegroundColor Green }; " ^
    "Write-Host '   DisableAntiSpyware     : ' -NoNewline; " ^
    "$v2 = (Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -EA SilentlyContinue).DisableAntiSpyware; " ^
    "if ($v2 -eq 1) { Write-Host 'DISABLED' -ForegroundColor Red } else { Write-Host 'Not set / Enabled' -ForegroundColor Green }; " ^
    "Write-Host '   WinDefend Service      : ' -NoNewline; " ^
    "$svc = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend' -Name Start -EA SilentlyContinue).Start; " ^
    "switch ($svc) { 2 { Write-Host 'Automatic (Normal)' -ForegroundColor Green } 3 { Write-Host 'Manual' -ForegroundColor Yellow } 4 { Write-Host 'Disabled' -ForegroundColor Red } default { Write-Host $svc } }; " ^
    "Write-Host ''; " ^
    "Write-Host '   --- Service Status ---' -ForegroundColor Cyan; " ^
    "$wds = Get-Service WinDefend -EA SilentlyContinue; " ^
    "Write-Host ('   WinDefend              : ' + $wds.Status); " ^
    "$shs = Get-Service SecurityHealthService -EA SilentlyContinue; " ^
    "Write-Host ('   SecurityHealthService  : ' + $shs.Status);"
echo.
pause
goto MENU