Permanent disabling of Windows Defender in Windows 11 qubes

Community Guides
1
Disclaimer

This is just a quick tip I would like to share as I have been looking for a solution for quite some time. It is not a strictly Qubes-specific guide (everything happens inside one qube) but it may be beneficial to have it in the community wiki as most of the other methods on the web are not really efficient. If it is not useful for the community, please delete the thread and accept my apology.

Credit

I am not the author of this method. Just “archiving” it here. Due credit

Background

Due to the specifics of Qubes, it is more likely one would not need to use Windows 11’s resource-wasting virus and firewall protection. However, disabling those the regular way does not survive reboot. The current method allows permanent disabling.

Tested and working on Windows 11 25H2.

*The author of this method wrote it for Windows 10. If anyone can provide feedback for other versions, we can append it.

Disabling Windows Defender

  1. Boot the Windows template in Safe mode.
  • Run msconfig
  • In tab ‘Boot’ check ‘Safe boot’ (Minimal)
  • press OK
  • Restart the qube

Qubes will show some errors related to qrexec agent, likely due to the service not running in Safe mode. Ignore that and continue.

  1. Run regedit
  2. Rename key HKLM\SYSTEM\CurrentControlSet\Services\WinDefend to something else, e.g. WinDefend-BLOCKED.
  3. Reboot the template qube normally
  • Run msconfig
  • In tab ‘General’ choose ‘Normal startup’
  • press OK
  • Restart the qube
  1. Check if Virus & threat protection is disabled.
  2. Disable Firewall & network protection notifications

In Windows Security - Notifications.

  1. Shut down the template qube.

All settings will propagate to newly booted AppVMs based on that template.

Re-enabling Windows Defender

To restore the state of the service, repeat the steps reverting to the original key name in Step 3.

1 Like