[BUG]: Disabling Windows Defender Services requires NT Authority

[ponei]

Describe the bug

Windows Defender service disabling scripts don't work under normal admin permissions; Changing some registry keys require NT Authority.

OS

Edition Windows 10 Home Single Language
Version 20H2
Compilação do SO 19042.928
Experiência Windows Feature Experience Pack 120.2212.551.0

Scripts

The whole "Disable Windows Defender Services" group

Additional information

I used a tool called PowerRun (https://www.sordum.org/9416/powerrun-v1-4-run-with-highest-privileges/) that emulates a process being called from TrustedInstaller, giving those extra permissions -- then the script ran without any errors. Also, consider adding more registry changes for better disabling (W4RH4WK/Debloat-Windows-10#273 (comment)).

[undergroundwires]

Thank you for your report. I can reproduce this. I'll add the scripts you suggest in the next minor version.

Regarding a better solution, changing protected registry areas can be done using PowerShell which is even used by Microsoft. If I'd appreciate if some could PoC with it and share I'd appreciate. I'm prioritizing #53 which will make it easy to embed larger PowerShell code like this in privacy.sexy.

[undergroundwires]

🎉 I wrote a working PoC with PowerShell. It will be added in privacy.sexy soon.

Is there any documentation on exactly which registry keys/tree are protected? Or I'd be happy for if you could share which registry keys that failed for you.

[ponei]

Personally I had problems with ControlSet001, ControlSet002 and CurrentControlSet
I couldn't find documentation citing that it needs higher permission unfortunately. I now tried changing them manually via regedit on my main machine and it worked without additional permission gains; maybe there's some layer of protection that you can disable that allows changing it without additional permissions?

[undergroundwires]

Thank you. I tested it and yes you're right. I can reproduce this. They're under Disable Windows Defender services, and I get ERROR: Access is denied for them. I also realized that some keys under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender are protected. So we should also take ownership of keys there before modifying them.

I can modify the rights on HKLM\SOFTWARE\Policies\Microsoft\Windows Defender so local administrator group is granted access (along with NT Authority) and can change it. However I could not get it working for some services under CurrentControlSet\Services such as reg add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f. Fix for the first part will be in the next version, so hopefully others can work on fixing the services part. Solutions like PowerRun are not very portable and we can't ship an UI application them along with privacy.sexy, but until the script is working for disabling service I'll put documentation for disabling Windows Defender services linking to this issue so people can use to run the scripts through it.

[ChrisDek]

Even if all permissions are fine there is a relatively new feature called "tamper protection" that makes disabling defender from scripts (nealry) impossible. See https://techrechard.com/completely-disable-microsoft-defender-in-windows-11/ for a tutorial with pictures

[ponei]

Even if all permissions are fine there is a relatively new feature called "tamper protection" that makes disabling defender from scripts (nealry) impossible. See https://techrechard.com/completely-disable-microsoft-defender-in-windows-11/ for a tutorial with pictures

Windows 11 is fairly new and it changed quite a bit regarding system integrity. Give it some time and people will start messing with it; Then we'll see how it goes.

[undergroundwires]

privacy.sexy 0.11.0 is now released with the fix 🥳 It can now disable Defender and SmartScreen, tested in both Windows 10 and Windows 11.

As you suggested @ponei, I added more registry changes. We have now more than 80 additional changes to disable it. Anything that are documented to be disabled are disabled now, there's references to documentation for each script. Now we have the richest pool compared to other scripts shared.

Also proud to implement a way of running as TrustedInstaller 🎉. First I thought it was not possible as I did not see single open-source script without third party dependencies that can disable those services, but in the end I could get it working. Thank you again @ponei for the issue explaining the root cause of the problem, it saved lots of time.

@ChrisDek, I tested on Windows 11 and tamper protection in W11 does hinder us. Also in this version we have a script (Turn off tamper protection) to disable it, but it only works in Windows 10. Only disabling SecurityHealthService was problematic on Windows 11, but it went good with registry + TrustedInstaller session.

More improvements to these scripts are planned, feel free to create new issues for ideas or something unexpected.

Note for other open-source developers: Feel free to use my code, but please show a reference to privacy.sexy somewhere visible to give credit.