7

I must warn you I don't use powershell much. I am trying to turn off windows defender real time protection via powershell I found the command Set-MpPreference -DisableRealtimeMonitoring $true and tried it in admin privileges only to get this

Set-MpPreference : Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring. At line:1 char:1
+ Set-MpPreference -DisableRealtimeMonitoring $true
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft...FT_MpPreference)
[Set-MpPreference], CimException
+ FullyQualifiedErrorId : HRESULT 0x800106ba,Set-MpPreference

Any thoughts?

G42
  • 9,791
  • 2
  • 19
  • 34
Zach Generic Name
  • 115
  • 1
  • 1
  • 8
  • This works for me but I have to run it manually with a shortcut key, as I posted here https://stackoverflow.com/a/65944287/10802144. – Saj Jan 28 '21 at 19:58

1 Answers1

9

The problem is that the Windows Defender antivirus services seem to be persistently disabled on your machine.

It's unfortunate that the Set-MpPreference cmdlet reports this in such an obscure fashion.

To fix this problem, re-enable the Windows Defender antivirus services:

The easiest way to do this is the following, but note that it involves a reboot:

Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' DisableAntiSpyware 0
Restart-Computer

  • You may instead use the Local Group Policy Editor-based method described in this windowscentral.com article or use regedit.exe's GUI or us the reg.exe CLI utility.

    • Note that the linked instructions are slightly outdated - instead of node Windows Defender, setting Turn off Windows Defender, target node Windows Defender Antivirus, setting Turn off Windows Defender Antivirus).

    • While using the Local Group Policy Editor (gpedit.msc) to turn the antivirus services off takes effect immediately, turning them back on can take minutes before the services are actually restarted (on the plus side, no reboot is required, unlike what the linked instructions say).

  • Note that if you reenable via the registry, such as via the above PowerShell command whereas disabling was originally performed via [local] group policy, that policy will continue to reflect the disabling (however, it is the registry setting that matters).

mklement0
  • 382,024
  • 64
  • 607
  • 775
  • 2
    This is one possible issue, but I'm pretty sure that there can be other issues that cause this, and I still haven't nailed them down. I see this error randomly on identically spun-up instances on AWS, using AWS-provided AMIs, where my Powershell script is run as part of the launch script. Sometimes it happens and sometimes it doesn't. I even added code before this point to check to make sure that the WinDefend service has started running before attempting to disable it, to no avail. I hope someone eventually comes along with a more complete answer, as this is extremely frustrating. – James Apr 13 '21 at 17:48