How to Disable Windows Defender on Windows Server 2019 and 2022

Before changing anything, create a rollback path and stage your replacement protection.

1. Enable and create a system restore point from an elevated PowerShell session:

The restore point captures system settings so you can revert Defender-related changes.

1. Export a full registry backup so you can restore keys if a later registry edit goes wrong. Open regedit as Administrator, select Computer at the top of the tree, then choose File > Export, set Export range to All, and save the .reg file to a safe location off the server.

1. Download the installer for your chosen third-party enterprise antivirus (for example Symantec Endpoint Protection, CrowdStrike Falcon, SentinelOne, or Trend Micro Deep Security) and copy it to the server - but do not install it yet. You install it later in the step that closes the security gap.

Never disable Defender without a replacement AV staged - the window between removing Defender and installing the new agent is a real exposure that attackers can exploit quickly. System restore points are limited on Server SKUs and may be disabled by policy; if Enable-ComputerRestore fails, rely on the registry export plus a full system/state backup instead.

Record a baseline so you can confirm the change worked and revert if needed.

1. List installed Defender-related Windows features.
2. List Defender services and their start type.
3. Read the current real-time protection preferences.

Run the commands below in an elevated PowerShell session. In the feature output, look for InstallState : Installed on Windows-Defender-Features. In the service list, the antivirus service is WinDefend.

Save or screenshot this output. You will compare against it after the disable/removal to confirm the process completed. Get-MpPreference only works while the Defender PowerShell module is present - once you fully uninstall Defender in Method 1, this cmdlet will no longer be available.

This is the most thorough method and prevents conflicts with a replacement AV. It removes the antivirus engine, GUI, PowerShell cmdlets, services, and drivers.

Open PowerShell as Administrator and run the uninstall. Use -Restart to reboot automatically, or -Remove to defer the restart to a maintenance window:

After the server restarts, verify removal. Get-WindowsFeature should report InstallState : Removed, and querying the WinDefend service should return nothing or an error that the service does not exist.

A restart is required to complete removal - plan for the reboot. This method fully removes Defender; do not use it on servers that rely on Microsoft Defender for Endpoint sensor functionality, since removing the antivirus platform can break EDR. Use passive mode (Method 3) in that scenario instead.

Use this when you cannot uninstall Defender or need consistent configuration across multiple servers. This disables protection but leaves the feature installed.

1. Open the Local Group Policy Editor by running gpedit.msc.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
3. Double-click Turn off Microsoft Defender Antivirus, set it to Enabled, and click OK.
4. Open the Real-time Protection subfolder and set these policies to Enabled: Turn off real-time protection, Turn off behavior monitoring, and Turn off process scanning.
5. Apply immediately with gpupdate /force, then verify with Get-MpPreference.

On current Windows Server builds, tamper protection and Microsoft's changes to the "Turn off Microsoft Defender Antivirus" behavior mean this policy may be ignored or not fully disable the engine. In a domain, apply the policy at the OU level for consistent configuration across the server fleet rather than editing each server locally.

Use the registry when you need specific control or when other methods do not work. Confirm you completed the registry export from the backup step first.

1. Open Registry Editor as Administrator with regedit.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender. Create the Windows Defender key if it does not exist.
3. Create these DWORD (32-bit) values set to 1: DisableAntiSpyware, DisableAntiVirus, DisableRealtimeMonitoring.
4. For servers running Microsoft Defender for Endpoint, instead navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection and create a DWORD ForceDefenderPassiveMode set to 1. This keeps Defender for Endpoint working while disabling local scanning.
5. Restart the server, then verify the value after reboot.

Incorrect registry edits can make a server unbootable - always export the registry first (see the backup step). On newer Windows Server builds, DisableAntiSpyware is ignored because Microsoft deprecated it in favor of tamper protection; if the value has no effect, use passive mode (ForceDefenderPassiveMode) or fully uninstall via Method 1. Do not set both DisableAntiVirus and passive mode on the same server - choose one intent.

This produces the identical result to the PowerShell uninstall in Method 1, using the GUI.

1. Open Server Manager and choose Manage > Remove Roles and Features.
2. Click Next through the wizard to the Features page.
3. Uncheck Windows Defender Features and its sub-components: GUI for Windows Defender, Windows Defender, and Windows Defender PowerShell Module.
4. Click Next, then Remove. The wizard prompts for a restart.
5. After restart, verify removal with Get-WindowsFeature.

Choose either this GUI method or Method 1 - do not run both. The end state is the same; this is only easier for administrators who prefer not to use the command line. A restart is required to finish removal.

Install your staged enterprise antivirus right after disabling Defender to minimize the exposure window.

1. Install your chosen product (for example Symantec Endpoint Protection, CrowdStrike Falcon, SentinelOne, or Trend Micro Deep Security) following the vendor's documentation.
2. Confirm its service is running.
3. Test detection with the EICAR test file, which is a harmless standard test string - real-time protection should quarantine it on write.
4. Configure real-time scanning, scheduled scans, application exclusions, and reporting/alerting per your organization's policy.

Create C:\temp first if it does not exist, or change the output path. If the EICAR file is not caught, the new agent's real-time protection is not active - resolve this before considering the server protected. Some corporate proxies block the EICAR download; if so, use your vendor's own test procedure instead.

Run a final verification pass to confirm Defender is gone (or disabled), the replacement AV is registered, and the server is stable.

1. Confirm no Defender services are running and no Defender features remain.
2. Check the registered antivirus in the Security Center namespace - it should list your new product, not Windows Defender.
3. Review top processes to catch any AV-related CPU or memory spikes.
4. Review the System event log for Defender-related errors.

The root\SecurityCenter2 namespace is present on Server with the Desktop Experience; on Server Core it may be unavailable, so rely on the service/feature checks there. Document this change and the verification commands in your server maintenance checklist so other administrators understand the security posture. If you used Method 4 passive mode, expect Defender services to still exist by design.