defendnot is a tool that disables Windows Defender by registering a fake antivirus through the Windows Security Center API.
The tool addresses the problem of disabling Windows Defender on Windows systems by leveraging the Windows Security Center interface rather than directly attacking Defender itself. It works by registering a fake antivirus product through the WSC API, which causes Windows to treat Defender as redundant and disable it. The approach includes an optional supplementary script that can strip additional Defender functionality by modifying registry policies related to real-time monitoring, behavior monitoring, cloud reporting, and signature updates.
Developers considering this tool should understand that it requires administrator privileges and may need temporary disabling of real-time protection and tamper protection before execution, as Defender will otherwise block the tool from running. On newer Windows 11 builds, Smart App Control may also need to be disabled first. The tool persists by adding itself to autorun to maintain the fake AV registration across reboots. The optional extra-strip script is separate because registry modifications are complex to reverse cleanly. This tool is suited for scenarios where legitimate system administration requires Defender to be disabled, though users bear full legal responsibility for compliance with applicable laws.
The project shows active maintenance with a documented reverse-engineering writeup explaining the WSC API approach. The codebase is written in C++ and includes both a loader binary and batch scripts for optional extended stripping of Defender policies. The tool acknowledges its limitations transparently, including the requirement to remain on disk for persistence and the complexity of cleanly undoing registry changes made by the optional extra-strip script.
