From 192b2d798cb226b7dbd6f983a327db0d0d437d23 Mon Sep 17 00:00:00 2001
From: Arsenii es3n1n <git@es3n1n.im>
Date: Sat, 15 Aug 2026 17:27:26 +0200
Subject: [PATCH] feat: add extra-strip.bat (#59)

---
 .github/workflows/build.yml |  1 +
 README.md                   |  8 +++++++-
 extra-strip.bat             | 30 ++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 extra-strip.bat

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2472ff7..cd17e7e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,6 +59,7 @@ jobs:
         Copy-Item -Path ".\out\$mappedPlatform\defendnot.pdb" -Destination ".\artifacts\$platform\" -Verbose
         Copy-Item -Path ".\out\$mappedPlatform\defendnot-loader.exe" -Destination ".\artifacts\$platform\" -Verbose
         Copy-Item -Path ".\out\$mappedPlatform\defendnot-loader.pdb" -Destination ".\artifacts\$platform\" -Verbose
+        Copy-Item -Path ".\extra-strip.bat" -Destination ".\artifacts\$platform\" -Verbose
       shell: pwsh
 
     - name: Upload artifacts
diff --git a/README.md b/README.md
index b7dffa0..71c8ca2 100644
--- a/README.md
+++ b/README.md
@@ -65,10 +65,16 @@ Optional arguments:
   --disable-autorun  disable autorun task creation
 ```
 
+## Stripping Defender out further (optional)
+
+defendnot only registers a fake AV through WSC, but if you want to strip more Defender stuff out, run the optional `extra-strip.bat` as admin after defendnot is active. It disables a bunch more Defender policies in registry: real-time monitoring, behavior monitoring, cloud reporting, signature updates, etc.
+
+It's a separate script because the keys are finicky and undoing them on `--disable` would mean saving every value first somewhere and writing all of them back, which is _waaay_ more bookkeeping than I feel like implementing.
+
 ## Limitations
 
 - **Needs to stay on disk:**  
-  To keep the AV registration persistent after reboot, defendnot adds itself to autorun. That means the binaries have to remain on your system.
+  To keep the AV registration after reboot, defendnot adds itself to autorun.
 
 ## Writeup
 
diff --git a/extra-strip.bat b/extra-strip.bat
new file mode 100644
index 0000000..8062d81
--- /dev/null
+++ b/extra-strip.bat
@@ -0,0 +1,30 @@
+:: based on https://github.com/es3n1n/defendnot/issues/49 comments
+@echo off
+setlocal
+
+net session >nul 2>&1
+if %errorlevel% neq 0 (
+    echo This script needs administrator rights
+    pause
+    exit /b 1
+)
+
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 00000000 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIntrusionPreventionSystem /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRawWriteNotification /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableUpdateOnStartupWithoutEngine /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v UpdateOnStartup /t REG_DWORD /d 00000000 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 00000001 /f
+reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 00000000 /f
+
+echo All done, please restart your machine to apply these changes
+pause
+endlocal