Как отключить защитник windows server 2016

Содержание:

• Графический интерфейс Windows Defender
• Удаление антивируса Microsoft Defender в Windows Server 2019 и 2016
• Управление Windows Defender с помощью PowerShell
• Добавить исключения в антивирусе Windows Defender
• Получаем статус Windows Defender с удаленных компьютеров через PowerShell
• Обновление антивируса Windows Defender
• Управление настройками Microsoft Defender Antivirus с помощью GPO

Для удаления графического консоли Defender используется командлет:
Uninstall-WindowsFeature -Name Windows-Defender-GUI

Если вы не можете открыть меню настроек Defender, а при запуске апплета Windows Security у вас появляется ошибка “You’ll need a new app to open this windowsdefender”, нужно перерегистрировать APPX приложение с помощью файла манифеста такой командой PowerShell:

Add-AppxPackage -Register -DisableDevelopmentMode "C:WindowsSystemAppsMicrosoft.Windows.SecHealthUI_cw5n1h2txyewyAppXManifest.xml"

Если APPX приложение полностью удалено, можно его восстановить вручную по аналогии с восстановлением приложения Micorosft Store.

Установить службы Windows Defender можно командой:

Add-WindowsFeature Windows-Defender-Features,Windows-Defender-GUI

Включить защиту в реальном времени:

Set-MpPreference -DisableRealtimeMonitoring $false

В Windows Server 2016 и 2019 по умолчанию установлен и включен “родной” бесплатный антивирус Microsoft — Windows Defender (начиная с Windows 10 2004 используется название Microsoft Defender). В этой статье мы рассмотрим особенности настройки и управления антивирусом Windows Defender в Windows Server 2019/2016.

Графический интерфейс Windows Defender

В версиях Windows Server 2016 и 2019 (в том числе в Core редакции) уже встроен движок антивируса Windows Defender (Защитник Windows). Вы можете проверить наличие установленного компонента Windows Defender Antivirus с помощью PowerShell:

Get-WindowsFeature | Where-Object {$_. name -like "*defender*"} | ft Name,DisplayName,Installstate

Однако в Windows Server 2016 у Windows Defender по-умолчанию нет графического интерфейса управления. Вы можете установить графическую оболочку Windows Defender в Windows Server 2016 через консоль Server Manager (Add Roles and Features -> Features -> Windows Defender Features -> компонент GUI for Windows Defender).

Установить графический компонент антивируса Windows Defender можно с помощью PowerShell командлета Install-WindowsFeature:

Install-WindowsFeature -Name Windows-Defender-GUI

Для удаления графического консоли Defender используется командлет:
Uninstall-WindowsFeature -Name Windows-Defender-GUI

В Windows Server 2019 графический интерфейс Defender основан на APPX приложении и доступен через меню Windows Security (панель Settings -> Update and Security).

Настройка Windows Defender производится через меню “Virus and threat protection”.

Удаление антивируса Microsoft Defender в Windows Server 2019 и 2016

В Windows 10 при установке любого стороннего антивируса (Kaspersky, McAfee, Symantec, и т.д.) встроенный антивирус Windows Defender автоматически отключается, однако в Windows Server этого не происходит. Отключать компонент встроенного антивируса нужно вручную (в большинстве случаев не рекомендуется использовать одновременно несколько разных антивирусов на одном компьютере/сервере).

Удалить компонент Windows Defender в Windows Server 2019/2016 можно из графической консоли Server Manager или такой PowerShell командой:

Uninstall-WindowsFeature -Name Windows-Defender

Не удаляйте Windows Defender, если на сервере отсутствует другой антивирус.

Управление Windows Defender с помощью PowerShell

Рассмотрим типовые команды PowerShell, которые можно использовать для управления антивирусом Windows Defender.

Проверить, запущена ли служба Windows Defender Antivirus Service можно с помощью команды PowerShell Get-Service:

Get-Service WinDefend

Как вы видите, служба запушена (статус –
Running
).

Текущие настройки и статус Defender можно вывести с помощью командлета:

Get-MpComputerStatus

Вывод комадлета содержит версию и дату обновления антивирусных баз (AntivirusSignatureLastUpdated, AntispywareSignatureLastUpdated), включенные компоненты антвируса, время последнего сканирования (QuickScanStartTime) и т.д.

Отключить защиту в реальном времени Windows Defender (RealTimeProtectionEnabled) можно с помощью команды:

Set-MpPreference -DisableRealtimeMonitoring $true

После выполнения данной команды, антивирус не будет сканировать на лету все обрабатываемые системой файлы.

Более полный список командлетов PowerShell, которые можно использовать для управления антивирусом есть в статье Управление Windows Defender с помощью PowerShell.

Добавить исключения в антивирусе Windows Defender

В антивирусе Microsoft можно задать список исключений – это имена, расширения файлов, каталоги, которые нужно исключить из автоматической проверки антивирусом Windows Defender.

Особенность Защитника в Windows Server – он автоматически генерируемый список исключений антивируса, который применяется в зависимости от установленных ролей сервера. Например, при установке роли Hyper-V в исключения антивируса добавляются файлы виртуальных и дифференциальных дисков, vhds дисков (*.vhd, *.vhdx, *.avhd), снапшоты и другие файлы виртуальных машин, каталоги и процессы Hyper-V (Vmms.exe, Vmwp.exe)

Если нужно отключить автоматические исключения Microsoft Defender, выполните команду:

Set-MpPreference -DisableAutoExclusions $true

Чтобы вручную добавить определенные каталоги в список исключения антивируса, выполните команду:

Set-MpPreference -ExclusionPath "C:Test", "C:VM", "C:Nano"

Чтобы исключить антивирусную проверку определенных процессов, выполните команду:

Set-MpPreference -ExclusionProcess "vmms.exe", "Vmwp.exe"

Получаем статус Windows Defender с удаленных компьютеров через PowerShell

Вы можете удаленно опросить состояние Microsoft Defender на удаленных компьютерах с помощью PowerShell. Следующий простой скрипт при помощи командлета Get-ADComputer выберет все Windows Server хосты в домене и через WinRM (командлетом Invoke-Command) получит состояние антивируса, время последнего обновления баз и т.д.

$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderinfo= Invoke-Command $server -ScriptBlock {Get-MpComputerStatus | Select-Object -Property Antivirusenabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,QuickScanAge,FullScanAge}
If ($defenderinfo) {
$objReport = [PSCustomObject]@{
User = $defenderinfo.PSComputername
Antivirusenabled = $defenderinfo.Antivirusenabled
RealTimeProtectionEnabled = $defenderinfo.RealTimeProtectionEnabled
AntivirusSignatureLastUpdated = $defenderinfo.AntivirusSignatureLastUpdated
QuickScanAge = $defenderinfo.QuickScanAge
FullScanAge = $defenderinfo.FullScanAge
}
$Report += $objReport
}
}
$Report|ft

Для получения информации о срабатываниях антивируса с удаленных компьютеров можно использовать такой PowerShell скрипт:

$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderalerts= Invoke-Command $server -ScriptBlock {Get-MpThreatDetection | Select-Object -Property DomainUser,ProcessName,InitialDetectionTime ,CleaningActionID,Resources }
If ($defenderalerts) {
foreach ($defenderalert in $defenderalerts) {
$objReport = [PSCustomObject]@{
Computer = $defenderalert.PSComputername
DomainUser = $defenderalert.DomainUser
ProcessName = $defenderalert.ProcessName
InitialDetectionTime = $defenderalert.InitialDetectionTime
CleaningActionID = $defenderalert.CleaningActionID
Resources = $defenderalert.Resources
}
$Report += $objReport
}
}
}
$Report|ft

В отчете видно имя зараженного файла, выполненное действие, пользователь и процесс-владелец.

Обновление антивируса Windows Defender

Антивирус Windows Defender может автоматически обновляться из Интернета с серверов Windows Update. Если в вашей внутренней сети установлен сервер WSUS, антивирус может получать обновления с него. Убедитесь, что установка обновлений одобрена на стороне WSUS сервера (в консоли WSUS обновления антивирусных баз Windows Defender, называются Definition Updates), а клиенты нацелены на нужный сервер WSUS с помощью GPO.

В некоторых случаях, после получения кривого обновления, Защитник Windows может работать некорректно. В этом случае рекомендуется сбросить текущие базы и перекачать их заново:

"%PROGRAMFILES%Windows DefenderMPCMDRUN.exe" -RemoveDefinitions -All
"%PROGRAMFILES%Windows DefenderMPCMDRUN.exe" –SignatureUpdate

Если на сервере нет прямого доступа в Интернет, вы можете настроить обновление Microsoft Defender из сетевой папки.

Скачайте обновления Windows Defender вручную (https://www.microsoft.com/en-us/wdsi/defenderupdates) и помесите в сетевую папку.

Укажите путь к сетевому каталогу с обновлениями в настройках Defender:
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources fs01UpdatesDefender

Запустите обновление базы сигнатур:

Update-MpSignature -UpdateSource FileShares

Управление настройками Microsoft Defender Antivirus с помощью GPO

Вы можете управлять основными параметрами Microsoft Defender на компьютерах и серверах домена централизованно с помощью GPO. Для этого используется отдельный раздел групповых политик Computer Configurations -> Administrative Template -> Windows Component -> Windows Defender Antivirus.

В этом разделе доступно более 100 различных параметров для управления настройками Microsoft Defender.

Например, для отключения антивируса Microsoft Defender нужно включить параметр GPO Turn off Windows Defender Antivirus.

Более подробно о доступных параметрах групповых политик Defender можно посмотреть здесь https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus

Централизованное управление Windows Defender доступно через Advanced Threat Protection доступно через портал “Azure Security Center” (ASC) при наличии подписки (около 15$ за сервер в месяц).

Install-WindowsFeature -Name Windows-Defender-GUI

Uninstall-WindowsFeature -Name Windows-Defender-GUI

Uninstall-WindowsFeature -Name Windows-Defender

Install-WindowsFeature -Name Windows-Defender

sc query Windefend

https://docs.microsoft.com/ru-ru/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016

Windows Defender Antivirus is Microsoft’s free built-in antivirus that comes installed by default on Windows Server 2016 and 2019 (since Windows 10 2004 the name Microsoft Defender is used). In this article we’ll look at the features of Windows Defender on Windows Server 2019/2016.

Enable Windows Defender GUI on Windows Server

Windows Server 2016 and 2019 (including the Core edition) have the Windows Defender Antivirus engine built in. You can check if Windows Defender Antivirus is installed using PowerShell:

Get-WindowsFeature | Where-Object {$_. name -like "*defender*"} | ft Name,DisplayName,Installstate

However, there is no Windows Defender Antivirus GUI in Windows Server 2016 by default. You can install the Windows Defender graphical interface on Windows Server 2016 through the Server Manager console (Add Roles and Features -> Features -> Windows Defender Features -> GUI for Windows Defender feature).

Or, you can enable the Windows Defender antivirus GUI using PowerShell:

Install-WindowsFeature -Name Windows-Defender-GUI

To uninstall the Defender GUI, the following PowerShell command is used:

Uninstall-WindowsFeature -Name Windows-Defender-GUI

In Windows Server 2019, the Defender GUI is based on the APPX application and is accessible through the Windows Security app (Settings -> Update and Security ).

Windows Defender is configured through the “Virus and threat protection” menu.

How to Uninstall Windows Defender Antivirus on Windows Server 2019 and 2016?

In Windows 10, when you install any third-party antivirus (McAfee, Norton, Avast, Kaspersky, Symantec, etc.), the built-in Windows Defender antivirus is disabled. However, it doesn’t happen in Windows Server. You have to disable the built-in antivirus engine manually (in most cases, it is not recommended to use several antivirus programs at a time on one computer or server).

You can uninstall Windows Defender in Windows Server 2019/2016 using Server Manager or with the following PowerShell command:

Uninstall-WindowsFeature -Name Windows-Defender

Do not uninstall Windows Defender if there is no other antivirus on the server.

Managing Windows Defender Antivirus with PowerShell

Let’s consider typical PowerShell commands that you can use to manage Windows Defender Antivirus.

You can make sure if Windows Defender Antivirus service is running using this PowerShell command:

Get-Service WinDefend

As you can see, the service is started (Status – Running)

You can display the current status and settings of Defender using the following cmdlet:

Get-MpComputerStatus

The cmdlet displays the version and the date of the latest antivirus database update (AntivirusSignatureLastUpdated, AntispywareSignatureLastUpdated), enabled antivirus components, the time of the last scan (QuickScanStartTime), etc.

You can disable Windows Defender real time protection as follows:

Set-MpPreference -DisableRealtimeMonitoring $true

After executing this command, the antivirus will not scan in real time all files that are opened by the operating system or users.

For example, you need to enable scanning for external USB storage devices. Get the current settings with command:

Get-MpPreference | fl disable*

If the USB drive scanning is disabled (DisableRemovableDriveScanning = True), you can enable the scan using the command:

Set-MpPreference -DisableRemovableDriveScanning $false

A complete list of PowerShell cmdlets in the Windows Defender module can be displayed with the command:

Get-Command -Module Defender

How to Exclude Files and Folder from Windows Defender Antivirus Scans?

You can set the list of exclusions – these are names, file extensions, directories to be excluded from the automatic Windows Defender Antivirus scan. The peculiarity of Windows Defender in Windows Server 2019/2016 is the automatically generated list of exclusions applied depending on the installed Windows Server roles and features.

For example, if the Hyper-V role is installed, the following object will be added to the Defender exclusion list: virtual and differencing disks, VHDS disks (*.vhd, *.vhdx, *.avhd), snapshots, Hyper-V folders and processes (Vmms. exe, Vmwp.exe).

If you want to disable Microsoft Defender automatic exclusions on Windows Server, run the command:

Set-MpPreference -DisableAutoExclusions $true

To add the specific directories to the antivirus exclusion list manually, run this command:

Set-MpPreference -ExclusionPath "C:ISO", "C:VM", "C:Nano"

To exclude antivirus scanning of certain processes use the following command:

Set-MpPreference -ExclusionProcess "vmms.exe", "Vmwp.exe"

Get Windows Defender Status Reports from Remote Computers via PowerShell

You can get the Microsoft Defender Antivirus status from remote computers using PowerShell. The following simple script will find all Windows Server hosts in the AD domain and get the Defender state through WinRM (using the Invoke-Command cmdlet):

$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderinfo= Invoke-Command $server -ScriptBlock {Get-MpComputerStatus | Select-Object -Property Antivirusenabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,QuickScanAge,FullScanAge}
If ($defenderinfo) {
$objReport = [PSCustomObject]@{
User = $defenderinfo.PSComputername
Antivirusenabled = $defenderinfo.Antivirusenabled
RealTimeProtectionEnabled = $defenderinfo.RealTimeProtectionEnabled
AntivirusSignatureLastUpdated = $defenderinfo.AntivirusSignatureLastUpdated
QuickScanAge = $defenderinfo.QuickScanAge
FullScanAge = $defenderinfo.FullScanAge
}
$Report += $objReport
}
}
$Report|ft

To get information about antivirus detections, you can use the following PowerShell script:

$Report = @()
$servers = Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderalerts= Invoke-Command $server -ScriptBlock {Get-MpThreatDetection | Select-Object -Property DomainUser,ProcessName,InitialDetectionTime ,CleaningActionID,Resources }
If ($defenderalerts) {
foreach ($defenderalert in $defenderalerts) {
$objReport = [PSCustomObject]@{
Computer = $defenderalert.PSComputername
DomainUser = $defenderalert.DomainUser
ProcessName = $defenderalert.ProcessName
InitialDetectionTime = $defenderalert.InitialDetectionTime
CleaningActionID = $defenderalert.CleaningActionID
Resources = $defenderalert.Resources
}
$Report += $objReport
}
}
}
$Report|ft

The report shows the name of the infected file, the action performed, the user, and the owner process.

Updating Windows Defender Antivirus Definitions

Windows Defender Antivirus can automatically update online from Windows Update servers. If there is an internal WSUS server in your network, the Microsoft antivirus can receive updates from it. You just need to make sure that the installation of updates has been approved on your WSUS server (Windows Defender Antivirus updates are called Definition Updates in the WSUS console), and clients are targeted to the correct WSUS server using GPO.

In some cases, Windows Defender may work incorrectly after getting a broken update. Then it is recommended to reset current definitions database and download them again:

"%PROGRAMFILES%Windows DefenderMPCMDRUN.exe" -RemoveDefinitions -All
"%PROGRAMFILES%Windows DefenderMPCMDRUN.exe" –SignatureUpdate

If your Windows Server does not have direct access to the Internet, you can update Microsoft Defender from a network folder.

Download Windows Defender updates manually (https://www.microsoft.com/en-us/wdsi/defenderupdates) and place them to a shared network folder. Set the path to the shared folder with Defender updates:
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources mun-fs01Defender

Run the antivirus definition update:

Update-MpSignature -UpdateSource FileShares

Configure Windows Defender Using Group Policy

You can manage basic Microsoft Defender settings on computers and servers using Group Policy. Use the following GPO section: Computer Configurations -> Administrative Template -> Windows Component -> Windows Defender Antivirus.

This section provides over 100 different options for managing Microsoft Defender settings.

For example, to completely disable your antivirus, you must enable the GPO parameter “Turn off Windows Defender Antivirus”.

More information on the available Defender Group Policy settings can be found here. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus

Windows Defender centralized management is available via the Advanced Threat Protection on the Azure Security Center (ASC) portal with a paid subscription (about $15 per host/month).

Microsoft has been including its Windows Defender antivirus software in Windows 10, and now they’re also automatically including it and enabling it in Windows Server 2016. While this is welcomed by some organizations that may not have another antivirus solution, running multiple antivirus applications has been known to cause issues for a long time and has not been recommended by IT personnel for many years. In Windows 10, Windows Defender has an API that allows other antivirus programs to disable it to prevent issues. Unfortunately, Microsoft decided to remove that API option in Windows Server 2016, so even if you install another antivirus product, Windows Defender will still be enabled.

How To Disable Windows Defender In Roles And Features Wizard

The first place you can try to disable and remove Windows Defender is in the Roles and Features Wizard within Server Manager. Some people report that the option to remove Windows Defender is greyed out, which leaves Powershell.

• Open Server Manager
• Click Manage > Remove Roles And Features
• Click Next on the Before You Begin screen
• Click Next on the Server Selection screen
• Click Next on the Remove Server Roles screen
• On the Remove Features screen, uncheck Windows Defender Features if you’re able to and click Remove

How To Disable Windows Defender Using Powershell

If you’re unable to remove Windows Defender using the steps above, then you should be able to use Powershell to uninstall Windows Defender.

You can run sc query Windefend in a Command Prompt to see if Windows Defender is in the Running State.

• Open an administrative Powershell window
• Type Uninstall-WindowsFeature -Name Windows-Defender
• After pressing enter, you’ll need to restart the server to uninstall Windows Defender

If you decide to use Windows Defender later, you can run Install-WindowsFeature -Name Windows-Defender in Powershell and restart the server to reinstall Windows Defender.

• Remove From My Forums

• Question

• Hi,
  I’m wanting to switch to Defender however previously had a 3rd party AV and had the GPO «set to disable Defender.

  I’ve removed the 3rd party AV, rebooted, Changed the GPO setting «
  
  If you enable this policy setting, Windows Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software.

  If you disable this policy setting, Windows Defender Antivirus will run regardless of any other installed antivirus product.

  If you do not configure this policy setting, Windows will internally manage Windows Defender Antivirus. If you install another antivirus program, Windows automatically disables Windows Defender Antivirus. Otherwise, Windows Defender Antivirus will scan your
  computers for malware and other potentially unwanted software.

  Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured.» gpmc_settingname=»Turn off Windows Defender Antivirus» gpmc_settingpath=»Computer Configuration/Administrative
  Templates/Windows Components/Windows Defender Antivirus» gpmc_supported=»At least Windows Vista» tabindex=»0″>When opening Windows Defender on any 2016 server Defender is disabled, the services won’t start. The GUI presents like
  below. Clicking «Start Now» gets the Windows defender service up and running. But thats a very manual process to get a lot of servers up and running.

  I also have the scenario of how can this be done on Server 2016+ servers that don’t have the GUI e.g. command-line. Is there a command-line to start the service.

  Windows Defender services can’t be started manually. «WinDefend», errors with below. Event viewer «Windows Defender» doesnt record any errors. Tried also capturing what it’s doing via «Start Now» button using process monitor
  and haven’t been able to pinpoint how it can be started.

  

  

• Remove From My Forums

• Question

• Hi,
  I’m wanting to switch to Defender however previously had a 3rd party AV and had the GPO «set to disable Defender.

  I’ve removed the 3rd party AV, rebooted, Changed the GPO setting «
  
  If you enable this policy setting, Windows Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software.

  If you disable this policy setting, Windows Defender Antivirus will run regardless of any other installed antivirus product.

  If you do not configure this policy setting, Windows will internally manage Windows Defender Antivirus. If you install another antivirus program, Windows automatically disables Windows Defender Antivirus. Otherwise, Windows Defender Antivirus will scan your
  computers for malware and other potentially unwanted software.

  Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured.» gpmc_settingname=»Turn off Windows Defender Antivirus» gpmc_settingpath=»Computer Configuration/Administrative
  Templates/Windows Components/Windows Defender Antivirus» gpmc_supported=»At least Windows Vista» tabindex=»0″>When opening Windows Defender on any 2016 server Defender is disabled, the services won’t start. The GUI presents like
  below. Clicking «Start Now» gets the Windows defender service up and running. But thats a very manual process to get a lot of servers up and running.

  I also have the scenario of how can this be done on Server 2016+ servers that don’t have the GUI e.g. command-line. Is there a command-line to start the service.

  Windows Defender services can’t be started manually. «WinDefend», errors with below. Event viewer «Windows Defender» doesnt record any errors. Tried also capturing what it’s doing via «Start Now» button using process monitor
  and haven’t been able to pinpoint how it can be started.

  

  

Установка компонента выполняется командой:

Add-WindowsFeature Windows-Defender-Features,Windows-Defender-GUI

Включить защиту в реальном времени:

Set-MpPreference -DisableRealtimeMonitoring $false