Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 832951" data-attributes="member: 32260">I tested how works the Defender Control tool. It writes one policy key to disable WD and stops two Defender services:<ul>
<li data-xf-list-type="ul">Windows Defender Antivirus Network Inspection Service (WdNisSvc);</li>
<li data-xf-list-type="ul">Windows Defender Antivirus Service (WinDefend);</li>
</ul>The interesting thing is that after disabling WD by Defender Control tool, the WD Network protection still works on my test machine (tested on Windows 10 Home ver. 1903), even after restarting Windows. But, the blocked events are not logged. This is not what follows from Microsoft documentation for Network Protection:<table style='width: 100%'><tr><th>Windows 10 version</th><th>Windows Defender Antivirus</th></tr><tr><td>Windows 10 version 1709 or later</td><td><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus" target="_blank">Windows Defender AV real-time protection</a> and <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus" target="_blank">cloud-delivered protection</a> must be enabled</td></tr></table>This topic will require some additional research.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 832951, member: 32260"] I tested how works the Defender Control tool. It writes one policy key to disable WD and stops two Defender services: [LIST] [*]Windows Defender Antivirus Network Inspection Service (WdNisSvc); [*]Windows Defender Antivirus Service (WinDefend); [/LIST] The interesting thing is that after disabling WD by Defender Control tool, the WD Network protection still works on my test machine (tested on Windows 10 Home ver. 1903), even after restarting Windows. But, the blocked events are not logged. This is not what follows from Microsoft documentation for Network Protection: [TABLE] [TR] [TH]Windows 10 version[/TH] [TH]Windows Defender Antivirus[/TH] [/TR] [TR] [TD]Windows 10 version 1709 or later[/TD] [TD][URL='https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus']Windows Defender AV real-time protection[/URL] and [URL='https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus']cloud-delivered protection[/URL] must be enabled[/TD] [/TR] [/TABLE] This topic will require some additional research.(y) [/QUOTE]

Verification