[@echo off
chcp 65001 >nul
title Windows Defender 管理工具
setlocal EnableDelayedExpansion
:menu
cls
echo ===============================================
echo Windows Defender 管理工具
echo ===============================================
echo.
echo 1. 关闭 Windows Defender
echo 2. 开启 Windows Defender
echo 3. 检查当前状态
echo 4. 退出
echo.
echo ===============================================
set /p choice=请选择操作 (1/2/3/4):
if "%choice%"=="1" goto disable
if "%choice%"=="2" goto enable
if "%choice%"=="3" goto status
if "%choice%"=="4" goto exit
echo 输入无效，请重新选择！
timeout /t 2 >nul
goto menu
:disable
call :checkAdmin
echo 正在关闭Windows Defender...
echo.
:: 停止服务
echo [1/6] 停止Windows Defender服务...
net stop WinDefend >nul 2>&1
net stop WdNisSvc >nul 2>&1
net stop Sense >nul 2>&1
:: 禁用服务
echo [2/6] 禁用服务启动项...
sc config WinDefend start= disabled >nul 2>&1
sc config WdNisSvc start= disabled >nul 2>&1
sc config Sense start= disabled >nul 2>&1
:: 通过组策略禁用
echo [3/6] 修改组策略设置...
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f >nul 2>&1
:: 禁用实时保护
echo [4/6] 禁用实时保护...
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f >nul 2>&1
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f >nul 2>&1
:: 禁用安全中心通知
echo [5/6] 禁用安全通知...
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Security Health\State" /v "UacDisableNotify" /t REG_DWORD /d 1 /f >nul 2>&1
:: 关闭Tamper Protection相关设置
echo [6/6] 应用最终设置...
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f >nul 2>&1
echo.
echo ===============================================
echo Windows Defender 已成功关闭！
echo ===============================================
echo.
echo [注意] 安全警告：系统现在没有实时防护！
echo [注意] 建议安装其他杀毒软件来保护系统安全
echo.
echo 重启后设置将完全生效。
goto pause_return
:enable
call :checkAdmin
echo 正在开启Windows Defender...
echo.
:: 删除禁用设置
echo [1/5] 删除禁用设置...
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /f >nul 2>&1
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Security Health\State" /v "UacDisableNotify" /f >nul 2>&1
:: 启用服务
echo [2/5] 启用服务启动项...
sc config WinDefend start= auto >nul 2>&1
sc config WdNisSvc start= manual >nul 2>&1
sc config Sense start= auto >nul 2>&1
:: 启动服务
echo [3/5] 启动Windows Defender服务...
net start WinDefend >nul 2>&1
net start Sense >nul 2>&1
:: 恢复Tamper Protection
echo [4/5] 恢复安全设置...
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 1 /f >nul 2>&1
:: 重置Windows安全中心
echo [5/5] 重置安全中心...
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /f >nul 2>&1
echo.
echo ===============================================
echo Windows Defender 已成功开启！
echo ===============================================
echo.
echo [完成] 系统实时防护已恢复
echo 建议运行Windows更新以确保病毒定义最新
goto pause_return
:status
cls
echo ===============================================
echo Windows Defender 状态检查
echo ===============================================
echo.
echo [服务状态]:
sc query WinDefend | findstr "STATE" >nul
if %errorlevel%==0 (
for /f "tokens=4" %%i in ('sc query WinDefend ^| findstr "STATE"') do (
if "%%i"=="RUNNING" (
echo [正常] Windows Defender服务: 正在运行
) else (
echo [关闭] Windows Defender服务: 已停止
)
)
) else (
echo [关闭] Windows Defender服务: 未找到
)
echo.
echo [组策略设置]:
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" >nul 2>&1
if %errorlevel%==0 (
for /f "tokens=3" %%i in ('reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" 2^>nul') do (
if "%%i"=="0x1" (
echo [关闭] Windows Defender: 已被组策略禁用
) else (
echo [正常] Windows Defender: 组策略启用
)
)
) else (
echo [正常] Windows Defender: 组策略未禁用
)
echo.
echo [实时保护]:
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" >nul 2>&1
if %errorlevel%==0 (
echo [关闭] 实时保护: 已禁用
) else (
echo [正常] 实时保护: 已启用
)
goto pause_return
:checkAdmin
net session >nul 2>&1
if %errorLevel% neq 0 (
echo.
echo [错误] 请以管理员身份运行此脚本！
echo 右键点击 -> 以管理员身份运行
echo.
pause
exit /b
)
exit /b
:pause_return
echo.
echo 按任意键返回主菜单...
pause >nul
goto menu
:exit
cls
echo 感谢使用Windows Defender管理工具！
echo.
timeout /t 2 >nul
exit]