Log into your Domain Controller and edit the Default Domain Policy under Group Policy Management.

• Under Default Domain Policy

  • Computer Configuration —> Administrative Templates —> Windows Components —> Microsoft Defender Antivirus —> Turn off Microsoft Defender Antivirus (Enable)

  

  Then select the ‘Real-time Protection’ folder.

  

  Turn off real-time protection

  

  Now log into Windows as UserA.

  • Reminder: This is the user with SeDebugPrivilege

  

  Bring open the Security Interface and choose ‘Virus & Threat Protection.’

  

  Choose Manage Settings

  

  In order for the group policy settings to take effect, we need to toggle off ‘Tamper Protection’

  

  Enter your domain administrator credentials

  

  Open up PowerShell and type:

  gpupdate /force
  

  • You should see ‘Real-Time’ protection toggle off and grey out.

  

Congratulations, you just permanently disabled Windows Defender on this machine!