Hit WIN-R in target/victim Windows VM and type gpedit.msc

Under Local Computer Policy Find:

• Computer Configuration —> Administrative Templates —> Windows Components —> Microsoft Defender Antivirus —> Turn off Microsoft Defender Antivirus (Enable)

Then select the ‘Real-time Protection’ folder.

Turn off real-time protection

Open the Windows Security Interface and choose ‘Virus & Threat Protection.’

Choose Manage Settings

In order for the group policy settings to take effect, we need to toggle ‘Tamper Protection’ to the ‘Off’ position.

Open up PowerShell and type:

gpupdate /force

• You should see ‘Real-Time’ protection toggle off and grey out.