В Windows Server 2016 и 2019 по умолчанию установлен и включен “родной” бесплатный антивирус Microsoft — Windows Defender (начиная с Windows 10 2004 используется название Microsoft Defender). В этой статье мы рассмотрим особенности настройки и управления антивирусом Windows Defender в Windows Server 2019/2016.
Содержание:
- Графический интерфейс Windows Defender
- Удаление антивируса Microsoft Defender в Windows Server 2019 и 2016
- Управление Windows Defender с помощью PowerShell
- Добавить исключения в антивирусе Windows Defender
- Получаем статус Windows Defender с удаленных компьютеров через PowerShell
- Обновление антивируса Windows Defender
- Управление настройками Microsoft Defender Antivirus с помощью GPO
Графический интерфейс Windows Defender
В версиях Windows Server 2016 и 2019 (в том числе в Core редакции) уже встроен движок антивируса Windows Defender (Защитник Windows). Вы можете проверить наличие установленного компонента Windows Defender Antivirus с помощью PowerShell:
Get-WindowsFeature | Where-Object {$_. name -like "*defender*"} | ft Name,DisplayName,Installstate
Однако в Windows Server 2016 у Windows Defender по-умолчанию нет графического интерфейса управления. Вы можете установить графическую оболочку Windows Defender в Windows Server 2016 через консоль Server Manager (Add Roles and Features -> Features -> Windows Defender Features -> компонент GUI for Windows Defender).
Установить графический компонент антивируса Windows Defender можно с помощью PowerShell командлета Install-WindowsFeature:
Install-WindowsFeature -Name Windows-Defender-GUI
Для удаления графического консоли Defender используется командлет:
Uninstall-WindowsFeature -Name Windows-Defender-GUI
В Windows Server 2019 графический интерфейс Defender основан на APPX приложении и доступен через меню Windows Security (панель Settings -> Update and Security).
Настройка Windows Defender производится через меню “Virus and threat protection”.
Если вы не можете открыть меню настроек Defender, а при запуске апплета Windows Security у вас появляется ошибка “You’ll need a new app to open this windowsdefender”, нужно перерегистрировать APPX приложение с помощью файла манифеста такой командой PowerShell:
Add-AppxPackage -Register -DisableDevelopmentMode "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppXManifest.xml"
Если APPX приложение полностью удалено, можно его восстановить вручную по аналогии с восстановлением приложения Micorosft Store.
Удаление антивируса Microsoft Defender в Windows Server 2019 и 2016
В Windows 10 при установке любого стороннего антивируса (Kaspersky, McAfee, Symantec, и т.д.) встроенный антивирус Windows Defender автоматически отключается, однако в Windows Server этого не происходит. Отключать компонент встроенного антивируса нужно вручную (в большинстве случаев не рекомендуется использовать одновременно несколько разных антивирусов на одном компьютере/сервере).
Удалить компонент Windows Defender в Windows Server 2019/2016 можно из графической консоли Server Manager или такой PowerShell командой:
Uninstall-WindowsFeature -Name Windows-Defender
Не удаляйте Windows Defender, если на сервере отсутствует другой антивирус.
Установить службы Windows Defender можно командой:
Add-WindowsFeature Windows-Defender-Features,Windows-Defender-GUI
Управление Windows Defender с помощью PowerShell
Рассмотрим типовые команды PowerShell, которые можно использовать для управления антивирусом Windows Defender.
Проверить, запущена ли служба Windows Defender Antivirus Service можно с помощью команды PowerShell Get-Service:
Get-Service WinDefend
Как вы видите, служба запушена (статус –
Running
).
Текущие настройки и статус Defender можно вывести с помощью командлета:
Get-MpComputerStatus
Вывод комадлета содержит версию и дату обновления антивирусных баз (AntivirusSignatureLastUpdated, AntispywareSignatureLastUpdated), включенные компоненты антвируса, время последнего сканирования (QuickScanStartTime) и т.д.
Отключить защиту в реальном времени Windows Defender (RealTimeProtectionEnabled) можно с помощью команды:
Set-MpPreference -DisableRealtimeMonitoring $true
После выполнения данной команды, антивирус не будет сканировать на лету все обрабатываемые системой файлы.
Включить защиту в реальном времени:
Set-MpPreference -DisableRealtimeMonitoring $false
Более полный список командлетов PowerShell, которые можно использовать для управления антивирусом есть в статье Управление Windows Defender с помощью PowerShell.
Добавить исключения в антивирусе Windows Defender
В антивирусе Microsoft можно задать список исключений – это имена, расширения файлов, каталоги, которые нужно исключить из автоматической проверки антивирусом Windows Defender.
Особенность Защитника в Windows Server – он автоматически генерируемый список исключений антивируса, который применяется в зависимости от установленных ролей сервера. Например, при установке роли Hyper-V в исключения антивируса добавляются файлы виртуальных и дифференциальных дисков, vhds дисков (*.vhd, *.vhdx, *.avhd), снапшоты и другие файлы виртуальных машин, каталоги и процессы Hyper-V (Vmms.exe, Vmwp.exe)
Если нужно отключить автоматические исключения Microsoft Defender, выполните команду:
Set-MpPreference -DisableAutoExclusions $true
Чтобы вручную добавить определенные каталоги в список исключения антивируса, выполните команду:
Set-MpPreference -ExclusionPath "C:\Test", "C:\VM", "C:\Nano"
Чтобы исключить антивирусную проверку определенных процессов, выполните команду:
Set-MpPreference -ExclusionProcess "vmms.exe", "Vmwp.exe"
Получаем статус Windows Defender с удаленных компьютеров через PowerShell
Вы можете удаленно опросить состояние Microsoft Defender на удаленных компьютерах с помощью PowerShell. Следующий простой скрипт при помощи командлета Get-ADComputer выберет все Windows Server хосты в домене и через WinRM (командлетом Invoke-Command) получит состояние антивируса, время последнего обновления баз и т.д.
$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderinfo= Invoke-Command $server -ScriptBlock {Get-MpComputerStatus | Select-Object -Property Antivirusenabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated,QuickScanAge,FullScanAge}
If ($defenderinfo) {
$objReport = [PSCustomObject]@{
User = $defenderinfo.PSComputername
Antivirusenabled = $defenderinfo.Antivirusenabled
RealTimeProtectionEnabled = $defenderinfo.RealTimeProtectionEnabled
AntivirusSignatureLastUpdated = $defenderinfo.AntivirusSignatureLastUpdated
QuickScanAge = $defenderinfo.QuickScanAge
FullScanAge = $defenderinfo.FullScanAge
}
$Report += $objReport
}
}
$Report|ft
Для получения информации о срабатываниях антивируса с удаленных компьютеров можно использовать такой PowerShell скрипт:
$Report = @()
$servers= Get-ADComputer -Filter 'operatingsystem -like "*server*" -and enabled -eq "true"'| Select-Object -ExpandProperty Name
foreach ($server in $servers) {
$defenderalerts= Invoke-Command $server -ScriptBlock {Get-MpThreatDetection | Select-Object -Property DomainUser,ProcessName,InitialDetectionTime ,CleaningActionID,Resources }
If ($defenderalerts) {
foreach ($defenderalert in $defenderalerts) {
$objReport = [PSCustomObject]@{
Computer = $defenderalert.PSComputername
DomainUser = $defenderalert.DomainUser
ProcessName = $defenderalert.ProcessName
InitialDetectionTime = $defenderalert.InitialDetectionTime
CleaningActionID = $defenderalert.CleaningActionID
Resources = $defenderalert.Resources
}
$Report += $objReport
}
}
}
$Report|ft
В отчете видно имя зараженного файла, выполненное действие, пользователь и процесс-владелец.
Обновление антивируса Windows Defender
Антивирус Windows Defender может автоматически обновляться из Интернета с серверов Windows Update. Если в вашей внутренней сети установлен сервер WSUS, антивирус может получать обновления с него. Убедитесь, что установка обновлений одобрена на стороне WSUS сервера (в консоли WSUS обновления антивирусных баз Windows Defender, называются Definition Updates), а клиенты нацелены на нужный сервер WSUS с помощью GPO.
В некоторых случаях, после получения кривого обновления, Защитник Windows может работать некорректно. В этом случае рекомендуется сбросить текущие базы и перекачать их заново:
"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" -RemoveDefinitions -All
"%PROGRAMFILES%\Windows Defender\MPCMDRUN.exe" –SignatureUpdate
Если на сервере нет прямого доступа в Интернет, вы можете настроить обновление Microsoft Defender из сетевой папки.
Скачайте обновления Windows Defender вручную (https://www.microsoft.com/en-us/wdsi/defenderupdates) и помесите в сетевую папку.
Укажите путь к сетевому каталогу с обновлениями в настройках Defender:
Set-MpPreference -SignatureDefinitionUpdateFileSharesSources \\fs01\Updates\Defender
Запустите обновление базы сигнатур:
Update-MpSignature -UpdateSource FileShares
Управление настройками Microsoft Defender Antivirus с помощью GPO
Вы можете управлять основными параметрами Microsoft Defender на компьютерах и серверах домена централизованно с помощью GPO. Для этого используется отдельный раздел групповых политик Computer Configurations -> Administrative Template -> Windows Component -> Windows Defender Antivirus.
В этом разделе доступно более 100 различных параметров для управления настройками Microsoft Defender.
Например, для отключения антивируса Microsoft Defender нужно включить параметр GPO Turn off Windows Defender Antivirus.
Более подробно о доступных параметрах групповых политик Defender можно посмотреть здесь https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/use-group-policy-microsoft-defender-antivirus
Централизованное управление Windows Defender доступно через Advanced Threat Protection доступно через портал “Azure Security Center” (ASC) при наличии подписки (около 15$ за сервер в месяц).
,
This tutorial shows how to remove or disable the Windows Defender Antivirus protection in Windows Server 2016. As you may know, the Server 2016 has built-in antivirus and malware protection through the Windows Defender Application.
In Server 2016, if you want to use another another antivirus program to protect your Server, the Windows Defender will not disable itself (as it happens in Window 10) in order to maximize the protection in Server 2016. So, if you want to remove or disable Defender Antivirus in Server 2016, you have to do that, manually.
How to Disable or Uninstall Windows Defender Antivirus in Server 2016.
Part 1. How to Disable Windows Defender Real Time Protection in Windows Server 2016.
Part 2. How to Uninstall Windows Defender in Server 2016.
Part 1. How to Turn OFF Real Time Protection in Windows Defender in Server 2016.
To temporarily turn off the Windows Defender Real Time Protection in Server 2016 though GUI, go to Settings –> Update & security –> Windows Defender and set the Real Time Protection to OFF. *
To permanently disable Windows Defender in Windows Server 2016:
1. Open PowerShell as Administrator.
2. Type the following command:
- Set-MpPreference -DisableRealtimeMonitoring $true
Note: To turn on again, the real time protection give the following command in Windows PowerShell (Admin) and then restart the server:
- Set-MpPreference -DisableRealtimeMonitoring $false
Part 2. How to Uninstall Windows Defender in Server 2016.
To completely remove Windows Defender from the Windows Server 2016, you can use one of the following methods:
- Method 1. Uninstall Windows Defender using PowerShell.
- Method 2. Remove Windows Defender in Server 2016 using DISM command prompt (DISM).
- Method 3. Remove Windows Defender using the Remove Roles & Features wizard.
Method 1. Uninstall Windows Defender using PowerShell.
To remove Windows Defender using PowerShell:
1. Open PowerShell as Administrator.
2. Type the following command and press Type the following command and press Enter:
- Uninstall-WindowsFeature -Name Windows-Defender
3. Restart the server. *
* Note: To reinstall the Windows Defender feature, then give the following command in PowerShell:
- Install-WindowsFeature -Name Windows-Defender
Method 2. Remove Windows Defender in Server 2016 using DISM in command prompt.
To remove Defender using DISM: *
* Advice: Do not use this way (DISM), to remove the Windows Defender Feature, because the command removes also the Windows Defender installation package and makes impossible to reinstall the Windows Defender (of you want) in the future.
1. Open Command Prompt as Administrator.
2. Type the following command and press Enter:
- Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
3. Restart the server.
Method 3. Remove Windows Defender using the Remove Roles & Features wizard.
To Uninstall Windows Defender in Windows Server 2016.
1. Open Server Manager.
2. From Manage menu, click Remove Roles and Features.
3. Press Next at the first three (3) screens.
4. At Features options, uncheck the Windows Defender Features and click Next.
5. Click Remove to remove the Windows Defender.
6. Restart your server.
* Note: To reinstall Windows Defender Antivirus on Server 2016, follow the instructions below:
1. Open Server Manager and click Add Roles and Features.
2. Click Next at the first for (4) screens of the wizard.
3. At Features screen, check the Windows Defender Features, plus the ‘Windows Defender’ and the ‘GUI for Windows Defender’ checkboxes and click Next.
![image_thumb[33]_thumb](https://www.wintips.org/wp-content/uploads/2018/12/image_thumb33_thumb_thumb.png "image_thumb[33]_thumb")
4. At Confirmation screen click Install.
5. When the installation is completed click Close and restart your server.
That’s all folks! Did it work for you?
Please leave a comment in the comment section below or even better: like and share this blog post in the social networks to help spread the word about this solution.
If this article was useful for you, please consider supporting us by making a donation. Even $1 can a make a huge difference for us in our effort to continue to help others while keeping this site free:
- Author
- Recent Posts
Konstantinos is the founder and administrator of Wintips.org. Since 1995 he works and provides IT support as a computer and network expert to individuals and large companies. He is specialized in solving problems related to Windows or other Microsoft products (Windows Server, Office, Microsoft 365, etc.).
Download Windows Speedup Tool to fix errors and make PC run faster
If you want to partially uninstall Windows Security from Windows Server, this step-by-step guide will help you. You can use Server Manager and Windows PowerShell to uninstall Microsoft Defender Antivirus from Windows Server partially.
Note: It is not possible to uninstall Windows Security entirely from Windows Server. However, you can remove or uninstall Microsoft Defender Antivirus from your server. After removing Microsoft Defender from your server, you can then use another third-party security shield without any problem.
To uninstall Windows Security from Windows Server, follow these steps:
- Open the Server Manager on your computer.
- Click on Manage > Remove Roles and Features.
- Select the server from the Server Selection tab and click Next.
- Remove the tick from the Microsoft Defender Antivirus checkbox in the Features tab.
- Tick the Restart the destination server automatically if required checkbox and click on the Remove button.
To learn more about these steps, continue reading.
To get started, open the Server Manager on your computer and click on Manage > Remove Roles and Features. Then, select the destination server from the Server Selection tab and click on the Next button.
After that, click the Next button on the Server Roles tab. Once you do that, you will be landed on the Features tab. Here, you can find Microsoft Defender Antivirus. You must remove the tick from the corresponding checkbox and click the Next button.
For your information, this process requires a restart. You have two options to get it done. If you want to restart manually, click on the Remove button. However, if you want to restart automatically, tick the Restart the destination server automatically if required checkbox and click the Remove button.
Let it be finished. Do not close or interrupt the process in any way.
Once done, you cannot find the Microsoft Defender Antivirus section in Windows Security.
If you want to get it back, you can use the Server Manager to install Microsoft Defender Antivirus.
How to uninstall Microsoft Defender from Windows Server using PowerShell
To uninstall Microsoft Defender from Windows Server using PowerShell, follow these steps:
- Search for “powershell” in the Taskbar search box.
- Click on the individual search result.
- Enter this command: Uninstall-WindowsFeature -Name Windows-Defender
To know more about these steps, continue reading.
First, you need to open PowerShell on your server. For that, search for “powershell” in the Taskbar search box and click on the individual search result. Then, enter this command:
Uninstall-WindowsFeature -Name Windows-Defender
Once done, you cannot find Microsoft Defender Antivirus on your server. However, if you want to get it back, enter this command:
Install-WindowsFeature -Name Windows-Defender
That’s all! I hope this guide helped you.
Read: How to disable Antimalware Service Executable in Windows 11/10
How do I uninstall Windows Defender on Windows Server?
To uninstall Windows Defender or Microsoft Defender on Windows Server, open the Server Manager and click on Manage > Remove Roles and Features. In the Features tab, remove the tick from the Microsoft Defender Antivirus checkbox and click the Next button. Finally, restart your destination server.
Can Windows Security be uninstalled?
No, it is not possible to uninstall Windows Security from Windows Server. However, you can partially remove the antivirus functionality. To do so, open the PowerShell and enter the command: Uninstall-WindowsFeature -Name Windows-Defender.
Read: How to disable Windows Defender in Windows 11.
When he is not writing about Microsoft Windows or Office, Sudip likes to work with Photoshop. He has managed the front end and back end of many websites over the years. He is currently pursuing his Bachelor’s degree.
To remove Windows Defender using PowerShell, you can use the following command:
Set-MpPreference -DisableRealtimeMonitoring $true
This command temporarily disables real-time monitoring by Windows Defender. Please use it with caution and ensure you have adequate alternative security measures in place.
Understanding Windows Defender
What is Windows Defender?
Windows Defender is a built-in antivirus solution designed to protect Windows operating systems from malware and other security threats. It offers real-time protection, scanning capabilities, and numerous features to ensure users’ safety while using their devices. By default, Windows Defender operates in the background, scanning for threats and providing automatic updates.
Why Remove or Disable Windows Defender?
There may be several scenarios where you may find it necessary to remove Defender PowerShell or disable it temporarily. For instance, if you choose to install a third-party antivirus solution, it can conflict with Windows Defender, leading to performance issues or inaccurate readings. Additionally, some users may prefer to conduct specific operations without Defender’s interference, which can be sometimes perceived as overly aggressive in blocking potentially unwanted programs.
However, it is crucial to weigh the risks. Disabling Windows Defender can expose your system to vulnerabilities, increasing the likelihood of malware infections. Thus, it should be done with caution and ideally not as a permanent measure.
Understanding Microsoft.PowerShell.Commands.Internal.Format.FormatStartData
Prerequisites for Using PowerShell
Setting Up PowerShell
Before executing any PowerShell commands, you must access PowerShell in administrator mode. Click on the Windows start button, type «PowerShell,» right-click on the application, and select «Run as Administrator.» This step provides the necessary privileges to execute commands that affect system security settings.
Ensuring Sufficient Privileges
PowerShell commands, particularly those that modify security settings, require administrative privileges. If you’re running PowerShell without these rights, you will likely encounter permission errors.
Mastering Microsoft.PowerShell.Commands.WriteErrorException
Removing or Disabling Windows Defender via PowerShell
Using PowerShell Command
To remove Defender PowerShell, one can easily disable Windows Defender’s real-time monitoring, which stops it from automatically scanning for threats. Here’s the command:
Set-MpPreference -DisableRealtimeMonitoring $true
Explanation:
- This command utilizes the `Set-MpPreference` cmdlet to adjust the settings of Windows Defender, specifically disabling its real-time monitoring feature.
- Setting `-DisableRealtimeMonitoring` to `$true` stops Windows Defender from actively scanning your files as they open.
Complete Removal of Windows Defender
Understanding the Limitations
It’s important to recognize that completely removing Windows Defender isn’t straightforward and is often not recommended. Windows Defender is an integral part of the Windows operating system’s security framework, and attempts to remove it can lead to system instability or errors. Moreover, certain editions of Windows, especially the Pro and Enterprise versions, may have Defender deeply integrated, making complete removal challenging.
Attempting to Uninstall Defender
If you still prefer to try to remove Defender, you can issue the following command:
Uninstall-WindowsFeature -Name Windows-Defender-Features
Explanation:
- This command aims to uninstall Windows Defender features from your system. However, its success may vary depending on your version of Windows. Generally, comprehensive removal may not happen due to built-in protection policies.
Invoke-PowerShell: Mastering Command Execution Effortlessly
Alternative Methods to Disable Windows Defender
Using Windows Settings
For users who prefer a graphical interface, you can disable Windows Defender through the system settings. Simply navigate to Settings > Update & Security > Windows Security > Virus & Threat Protection and turn off the relevant Real-time protection toggle. This method is simple and doesn’t require using PowerShell.
Using Group Policy
Using Group Policy can also provide a method to configure Windows Defender settings. To access Group Policy:
- Press Windows + R to open the Run dialog.
- Type `gpedit.msc` and press Enter.
- Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus. From here, you can configure the desired settings to disable Defender.
Remotely Execute PowerShell: A Quick Start Guide
Verifying Windows Defender Status
Checking the Status of Windows Defender
To ensure that you’ve successfully disabled Windows Defender, you can use a PowerShell command to check its current status:
Get-MpPreference | Select-Object -Property DisableRealtimeMonitoring, DisableIOAVProtection
Explanation:
- This command retrieves the current preferences set for Windows Defender, specifically focusing on its ability to perform real-time monitoring and I/O (input/output) antivirus protection. The output will indicate whether these settings are disabled.
Confirming Successful Disabled State
If both properties show `True`, your attempt to remove Defender via PowerShell was successful. If they are still `False`, it implies that Windows Defender is still operational.
Get Folder PowerShell: A Quick Guide to Mastery
Re-enabling Windows Defender
Importance of Re-enabling Defender
After using another antivirus solution or diagnostic tasks, it is prudent to re-enable Windows Defender. Many threats evolve rapidly, and having an active antivirus program, even after temporarily disabling Defender, is essential for maintaining system integrity.
PowerShell Command to Re-enable
To re-enable Windows Defender and restore real-time monitoring, simply run the following PowerShell command:
Set-MpPreference -DisableRealtimeMonitoring $false
Explanation:
- Setting `-DisableRealtimeMonitoring` to `$false` instructs Windows Defender to resume its active protection against potential threats, ensuring that your system is once again safeguarded.
Mastering Counter PowerShell Commands in Minutes
Troubleshooting Common Issues
Common Errors Encountered
While trying to disable or remove Defender, you might encounter several common errors. Here are a few notable examples:
- Access Denied: This typically means you are not running PowerShell as an Administrator. Make sure to launch PowerShell with sufficient privileges.
- Command not recognized: Ensure that you are using the correct syntax. Typos can lead to PowerShell not recognizing your command.
Resources for Further Help
If you continue to experience issues or have specific questions, resources such as the Microsoft documentation provide comprehensive guidance on using PowerShell for system management. Community forums such as TechNet and Reddit can also be beneficial for peer support and troubleshooting assistance.
Unlocking ServiceNow PowerShell: A Quick Guide
Conclusion
In this comprehensive guide, you’ve learned how to remove Defender PowerShell or disable Windows Defender effectively. It is crucial to handle such operations with caution, being fully aware of the implications on your system security. Windows Defender plays a vital role in protecting your computer from threats, so ensure you maintain an active security posture once you’ve completed your tasks.
Elevated PowerShell: A Quick Start Guide
Call to Action
If you found this article helpful, consider signing up for our newsletter for more PowerShell tips and guidance. Share this article with anyone who might benefit from learning how to manage Windows Defender effectively!
On your Windows Server 2019, you can uninstall Windows Defender using a PowerShell command. In this short post, I will show you how to remove Windows Defender from your Windows Server 2019 OS.
The Windows Defender Antivirus is available on Windows Server 2016 and Windows Server 2019. You can also use the same steps to uninstall the Windows Defender on your Windows Server 2016 OS.
Windows Defender antivirus comes preinstalled with Windows Server 2016 and Windows Server 2019. In addition, the AV has built in ransomware protection feature that keeps your computer secure. However if you have a third-party antivirus or security software that you prefer to use, you may want to uninstall Defender anti-virus on your server.
Most of all in Windows Server, Windows Defender Antivirus does not automatically disable itself if you are running another antivirus product. For example when you install Sophos cloud protection on your Windows Server 2019, the Windows Defender services will still run on the server. You don’t want to run 2 security products that pretty much does same functions and eat your CPU.
We know that with other third-party anti-virus this is not the case. When you install any third-party anti-virus, it disables the other security products by default. You cannot uninstall this AV from add or remove programs. So to uninstall Windows Defender feature, you can use either PowerShell or use remove roles and features wizard.
If you want to use Windows Defender later, you can always run Install-WindowsFeature -Name Windows-Defender in PowerShell and restart the server to reinstall Windows Defender.
To uninstall or remove Windows Defender using PowerShell on Server 2019.
- Login to Windows Server 2019 with administrator account.
- Right click Start and click Windows PowerShell (admin).
- Enter the command Uninstall-WindowsFeature Windows-Defender.
- A server restart is required when you remove Windows Defender feature.
Restart the Windows Server 2019 and now you will notice Windows Defender is removed.