DisableAntiSpyware: How to Fix “Turn off Microsoft Defender AntiVirus” CIS Findings

Ensure ‘Turn off Microsoft Defender AntiVirus’ is set to ‘Disabled’ is a CIS benchmark check that fails when the DisableAntiSpyware policy value under HKLMSOFTWAREPoliciesMicrosoftWindows Defender is set to 1. Fix it by setting the Group Policy “Turn off Microsoft Defender Antivirus” to Disabled (value 0) or removing the value, unless another antivirus is intentionally primary.

What the scanner is actually detecting

This is a registry configuration check (credentialed for Tenable, agent-based for Wazuh), not a vulnerability detection. Microsoft’s Policy CSP reference maps the Group Policy Turn off Microsoft Defender Antivirus (WindowsDefender.admx) to the value DisableAntiSpyware in HKLMSOFTWAREPoliciesMicrosoftWindows Defender:

• Enabled writes 1: Defender does not run.
• Disabled writes 0: Defender runs regardless of any other installed antivirus product.
• Not Configured leaves no value: Windows manages Defender itself and turns it off automatically when you install another antivirus.

Older administrative templates name the same setting “Turn off Windows Defender” or “Turn off Windows Defender Antivirus”, so older reports may use those titles.

Real-world risk

If the value is 1 and Windows honors it, the host has no Microsoft antivirus: no real-time protection, no cloud-delivered protection, and none of the features that need Defender in active mode, such as network protection, controlled folder access and attack surface reduction rules. With no other antivirus installed, the machine is open to commodity malware.

In practice the value often does less than the finding suggests. Microsoft calls DisableAntiSpyware a legacy setting: its August 2020 platform notes (4.18.2008.9) say it is ignored, its reference page lists Windows clients on platform 4.18.2108.4 and later among the devices it no longer applies to, and tamper protection guards it. On servers onboarded to Defender for Endpoint (platform 4.18.2208.0 and later), the policy produces passive mode rather than a disabled antivirus. So on a current Windows 11 laptop this is usually leftover policy from an old antivirus migration, while on a server that is not onboarded it can still mean Defender is off.

Either way, a policy that switches off the antivirus should never be there by accident, and Defender for Endpoint treats attempts to turn off antivirus protection as potential tampering. If nobody can explain a value of 1, investigate the host before cleaning it up.

How to confirm it on the host

Read the policy value:

reg query "HKLMSOFTWAREPoliciesMicrosoftWindows Defender" /v DisableAntiSpyware

0x1 is the finding. An “unable to find” error means the policy is not configured. Then check what Defender is actually doing:

Get-MpComputerStatus | Select-Object AMRunningMode, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, IsTamperProtected

AMRunningMode Normal with AntivirusEnabled True means Defender is active and the policy is being ignored. Passive or EDR Block Mode usually means another antivirus is primary on a device onboarded to Defender for Endpoint. If Get-MpComputerStatus shows AntivirusEnabled False, or cannot return a status at all, Defender really is off.

Find out where the value comes from:

gpresult /h gpresult.html

Look for the policy Turn off Microsoft Defender Antivirus set to Enabled with a winning GPO, or a Group Policy Preferences registry item for DisableAntiSpyware. If neither appears, the value was written locally, for example with gpedit.msc, LGPO.exe or an imaging task sequence. Windows Security > Virus & threat protection > Manage providers shows which antivirus is registered.

How to fix it

First, decide which case you have

Why not push Disabled everywhere: Microsoft documents that value 0 forces Defender to run even when another antivirus is installed, and two products doing active protection side by side is not supported. Microsoft’s own advice is to leave this policy unconfigured; CIS asks for Disabled. On a host with no other antivirus, both states keep Defender running.

Domain-joined hosts: Group Policy

1. Open the winning GPO named in the gpresult report.
2. Go to Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Turn off Microsoft Defender Antivirus.
3. Set it to Disabled (CIS state) or Not Configured (Microsoft default).
4. If the value comes from a Group Policy Preferences registry item, edit that item instead: change its data to 0 or its action to Delete. Changing the administrative template does not touch a preference item.
5. Run gpupdate /force on a test host and repeat the checks above.

Standalone hosts: local policy or registry

Use gpedit.msc with the same path, or run one of these from an elevated prompt. For the CIS state (Disabled):

reg add "HKLMSOFTWAREPoliciesMicrosoftWindows Defender" /v DisableAntiSpyware /t REG_DWORD /d 0 /f

For the Microsoft default (Not Configured):

reg delete "HKLMSOFTWAREPoliciesMicrosoftWindows Defender" /v DisableAntiSpyware /f

A GPO that still sets the value overwrites this at the next refresh, and a value baked into your image returns with every new build, so fix the source first.

Intune-managed devices

The same setting is exposed as the ADMX-backed CSP ./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender (Windows 10 version 2004 with KB5005101 and later, and Windows 11). Set it to disabled, or remove the profile that enables it.

Servers that run another antivirus

Remove the DisableAntiSpyware value. If the server is onboarded to Defender for Endpoint, use passive mode, ideally set before onboarding: with tamper protection on, a server that has switched to active mode cannot be forced back to passive.

reg add "HKLMSOFTWAREPoliciesMicrosoftWindows Advanced Threat Protection" /v ForceDefenderPassiveMode /t REG_DWORD /d 1 /f

If it is not onboarded, Microsoft says to disable or uninstall Defender manually. Uninstalling is cleaner than a policy that every CIS scan flags:

Uninstall-WindowsFeature Windows-Defender

On Server 2016, also remove Windows-Defender-Gui, then restart. Record the CIS exception with the name of the primary product: the CIS rationale explicitly allows organizations using a third-party antivirus to exempt themselves. Which antivirus a server runs, and in which mode, is worth recording as part of your Windows Server hardening checklist.

Turning Defender back on

On Windows 10 and 11, Defender turns itself back on when no other antivirus is active and the policy no longer blocks it. On a server where it was disabled (Server 2016 in particular), remove the policy, run MpCmdRun from the newest folder under %ProgramData%MicrosoftWindows DefenderPlatform (or %ProgramFiles%Windows Defender if that folder is missing), and restart:

cd /d "%ProgramFiles%Windows Defender"
MpCmdRun.exe -WdEnable

If the feature was uninstalled on Server 2019 or later:

Dism /Online /Enable-Feature /FeatureName:Windows-Defender

Server 2016 also needs the Windows-Defender-Features and Windows-Defender-Gui features. Reboot, then install the latest platform update through Windows Update, because re-enabling Defender does not install it.

How to verify the fix and rescan

reg query "HKLMSOFTWAREPoliciesMicrosoftWindows Defender" /v DisableAntiSpyware
Get-MpComputerStatus | Select-Object AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled

Expect 0x0 or no value, AMRunningMode Normal, and both flags True (or Passive, or your documented exception, where another antivirus is primary). To check a batch of hosts:

Get-MpComputerStatus -CimSession (Get-Content .hosts.txt) |
    Select-Object PSComputerName, AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled

For Tenable, rerun the same CIS compliance scan and confirm the credentialed login worked, because a missing result is not a pass. For Wazuh, SCA scans when the agent starts and then every 12 hours by default, so restarting the agent gives a fresh result:

Restart-Service WazuhSvc

What can break and how to roll back

• Two antivirus engines at once. Forcing Defender on next to another real-time product is the main risk of the Disabled state. Microsoft warns that both products then try to provide active protection, which hurts performance and is not supported.
• Missing exclusions. Servers where Defender was off for years start real-time scanning. Carry over the exclusions your application vendors require before you change the policy.

To roll back, set the policy to Not Configured (not Enabled) and run gpupdate. For a server where Defender must stay out of the way, use passive mode or remove the feature as described above. Do not change the start values of the WinDefend, WdBoot, WdFilter, WdNisDrv or WdNisSvc services: Microsoft calls that unsupported and warns it may force a reimage.

Common false positive reasons

• Wazuh rule typos. At the time of writing (September 2026), the Wazuh main branch spells the key WindowsDefender, without the space, in cis_win2016.yml (check 16287) and cis_win2022.yml (check 27308). The Server 2016 check requires that nonexistent key, so it fails on every host; the Server 2022 check passes when it is missing, so it passes on every host, even with DisableAntiSpyware set to 1. Confirm on the host and correct the policy file.
• The value is 1 but Defender runs. Get-MpComputerStatus shows Normal mode and AntivirusEnabled True. The scanner is right about the registry and the real risk is low; clean up the policy anyway.
• Intentional third-party antivirus. This is an accepted exception, not a false positive. Record it instead of silently suppressing the check.
• Stale results. The report predates the policy refresh, or the rescan ran without working credentials.

FAQ

Is DisableAntiSpyware still honored on Windows 11?

Generally no, according to Microsoft. The CIS check still reads the registry, so the finding stays until the value is removed or set to 0.

Should I choose Disabled or Not Configured?

Disabled matches the CIS wording. Not Configured is Microsoft’s recommendation and the only safe choice where another antivirus is primary.

Defender shows as off, but the value is not set. Why?

On Windows 10 and 11, another registered antivirus makes Windows turn Defender off automatically. On a server, someone probably disabled or uninstalled it manually.

Do I need to reboot?

Not for the scanner, which reads the registry after a policy refresh. Re-enabling Defender on a server does need a restart.

Tracking this finding across many hosts

This finding usually traces back to one GPO or one image, so it appears on many hosts at once. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners, merges duplicates within each scanner (not across scanners), and its AI triage can flag results that look like false positives, with evidence, for a person to decide. It can also write host-specific remediation scripts that run only after human approval, deployed by its agents on Windows endpoints.

Sources

• Microsoft Learn: Policy CSP ADMX_MicrosoftDefenderAntivirus (DisableAntiSpywareDefender)
• Microsoft Learn: DisableAntiSpyware
• Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products
• Microsoft Learn: Troubleshoot Microsoft Defender Antivirus while migrating from a non-Microsoft solution
• Wazuh: CIS Windows Server 2022 SCA policy (cis_win2022.yml)