After reading the comments, this video shouldn't be interpreted as "Everyone should delete Defender", but more for those that don't web browse and are obsessed with performance. Also, I'm tired of folks saying "Defender is good enough". Yes, its better than nothing, but if I were ever to "Break Bad" the first people I'd go after is the windows defender users. For Antivirus Recommendations: Free Alternative: BitDefender Free or Kaspersky Cloud (Not great for privacy though) Paid Alternative: ESET Antivirus ONLY (Affiliate Link: christitus.com/antivirus) With any Antivirus do NOT buy an internet security or anything BUT the Antivirus ONLY!
Too late, already erased defender alongside system32 ... Because I switched to Linux lol. Don't worry, I think some people just hear what they want to hear in order to be outraged, because this is the Internet. Some are just being tribalistic (someone said you said this just because you are a "Linux fanboy" lmao). Keep up with the good content and thanks for the clarification.
@@Peshyy No, I don't think so. You still have to use a YT account to post, which means that certain identifiers for your device will be collected by the website, in this case YT, which can then be matched with your account. In the end, there is NO privacy or true anonymity on the internet, if that is what you strive for. If security of your device is what is desired then install an internet security software (I use [paid for] Kaspersky Total Security) and be careful where you visit and what you click on and even then that is no guarantee of security. Unfortunately, that's the reality.
@@elbmw Joking aside, avoid Electron apps as those have access to your real device. If you are using a browser, use different browsers for different purposes. Tor Browser is best if you need privacy. Brave does enough to reduce cross site tracking. If you have an account then anything you do with that account is tied to you. You want them to have a good fingerprint of your browser so they can protect your account from fraudulent access.
I remember you said just the opposite in a previous video, something like "don't use anti-virus, it is not necessary, Windows Defender is already protecting you", or something down this line. I may remember wrong, or mix it up and it was yet another tech guru, but I remember someone argued for that. Now what? :)
What Chris says about Defender is true for ALL anti-virus software. Has everyone forgotten that Defender is a rename of the anti-virus software MicroSoft acquired? It's just one of many.
Microsoft Defender is original called Microsoft Spynet in 2004, because of conspicuous people Microsoft Spynet was renamed. Microsoft at that time took initiative for things Edward S would say in the early 2010's here are words of wisdom, it's an acronym. M.I.C.R.O.S.O.F.T. Murder Intimidation Corruption Rape Obfuscation Spyware Observation Fear Trauma i am sorry it's this way because what we tend to do is act on what they made us believe that way. I am sorry so sorry 😔
I certainly don't miss having to deal with registry hacks in Windows. I left that behind for Linux in 2005. In tech support we called "scorched earth" "Nuke and Pave"...lol
@@parkman29 What's the point of having a registry? All software store their stuff in it and once you uninstall them, they leave their junk there and it slows down Windows. CPUs have gotten faster so that hides that fact a bit. The registry is a single point of failure and it looks like Windows is not able to recover from it.
@@louistournas120 Programs on Linux also leave behind configuration files in /etc and in ~/.config after you uninstall them. Even when you tell your package manager to purge the program, it does not remove everything. While I like the point about Nix, Nix’s config file is very different from the Windows registry. Sure, both of them exist as files, but on Windows, everything uses the registry constantly. So yes, the system could get slower with more garbage to parse. That is why a tool like Revo Uninstaller is so useful, as it cleans of the registry after uninstalling a program. As for the single point of failure bit, that is just poor design of Windows. Microsoft seems to have no interest in shipping an actually filesystem to users. ReFS is a BTRFS and ZFS competitor that Microsoft created, but only enterprise users can make use of it, and only for plain data drives. I make no attempt to defend Microsoft or Windows-I don’t like this behavior either. However, things are a little more complicated and nuanced than we sometimes give them credit for. From my understanding, “nuke and pave” refers to reinstalling the operating system. I suppose it could refer to getting rid of an antivirus and replacing it with another. The key is to both nuke the thing that’s done and then pave it over with something else.
@@OcteractSG I see. I suppose what should be done with these naughty Linux programs that leave behind files in .config and such is that when you install them, they should inform the package manager that during uninstall, it should look for certain files in certain locations and if they are found, they should be deleted. These are always easy to solve if there is the will to solve them. It seems to me that most of the time, the programmers are lazy (The Windows world) or the programmers treat the end user as an administrator (Linux world).
Let's hope that people importing such a registy file from a random github are smart enough to notice or look for a RunOnce registry key to wget a malware file and auto run it. Registry key-files are not inherrently safer than a batch file that runs a script. They are just to easier enable/undo your changes. The code and files of defender are still on your system.
I used many AV programs in recent years. All of them (beside the price) have also one common disadvantage. They are intrusive. They show dialogs, windows, messages, alerts when IMO they shouldn't. Also, they have conflicts with other software. Various weird problems that magically disappeared when the AV got disabled. Always some performance hit. So - actually I find the Windows Defender as the least intrusive. I use it not because it's good (I guess it's probably not). I use it because it takes no effort. It's just preinstalled by default, preconfigured, not a single click from me is needed. Then - IT SITS QUIET. Yes, sometimes it causes some system slowdown - especially after downloading a big game from Steam or installing a big program. I can tolerate this. This suboptimal protection is still better than no protection at all. I'm a power user, I don't install just anything on my PC, I don't even open e-mails from unknown senders. Still, any small tool or even a document you download from even a trusted site can contain some malware and it actually happens from time to time. If not Defender then what? My requirement is the program must be FASTER (because the greatest flaw of Defender is slowness) and as QUIET / maintenance free as Defender. The only time I want to see any notification from AV is when a real threat is found.
Couldn't agree more. I have a fast CPU, 32GB of RAM and a fast SSD, so I have no problems with anything slowing down. And it doesn't annoy me. And I don't have viruses.
Same, i don't download crack's or open sus mails or weird stuff so defender is fine for me and it's not too intrusive like you said. Imo windows defender is as good as it's pc owner.
THIS. Also, every other antivirus I've ever tried have been absolute resource hogs. Even the so called "cloud" based ones that claim to be super lightweight.
Chris, App control and XDR are features of Windows Defender Enterprise, you can control cloud apps, application prevalence and have alert and custom actions trough Cloud App security (Recently renamed to Defender for cloud apps). Thats great that some people talk about these scripts, but in a fully managed Windows Defender Enterprise the registry keys will be locked down and changes will be ignored.
Thank you, I was about to say this. To elaborate on this, it will send security alerts back to your SIEM. I think this is an example of a sysadmin who may not know how powerful Defender has gotten over the years. Its not an insult towards him, he's on the otherside of the house and isn't focused on that area.
Yes, this is definitely true and it’s unfortunate Microsoft doesn’t give consumers this same ability. It still does not score as well as CrowdStrike, Cortex, and GZ in MITRE evaluations. And just overall from experience both of these are more effective solutions to stop ATP ransomware deployed by nation-state actors than Defender for Endpoint.
indeed, defender for endpoint gives red teams a run for their money these days. defender is now an umbrella of products, endpoint being 1 of them and cloud apps which you mentioned being another. would be nice if it wasn't locked behind the E5 flavor of M365 to get more people onboarded.
@@diabilliq Defender for endpoint P2 license, MS engineer said you can have up to 5 devices per license. However licenses are applied to AAD users.. they are not deducted when I onboard devices.. which is odd....
Would love to see this added as an option in The Ultimate Windows Utility. Maybe add a recommended, free, anti-virus to the programs in The Ultimate Windows Utility.
For me Defender is all I need, I just boot to Windows so i can play Tarkov, 97% of the time I'm using Fedora, never had any problem with it besides one miner that destroyed it few years back.
That's because it does nothing... Absolutely sits there giving you the illusion that it's doing something but it is not! I switched to Linux mint 4 years ago, no need to run antivirus always updates for security and I still game as usual.... Life is swell in mint land.
@@susantompkins8810 Linux is great. I too use Mint at home. Unfortunately a lot of us are tethered to Window$ for enterprise reasons. A lot of businesses run on Micro$oft. Hopefully - virtualization via the cloud will take care of a lot the desktop problems I see everyday.
This is another interesting update on your thoughts on Windows Defender, following your video from a month ago, “Why I HATE Windows Defender” Disabling Windows Defender and/ or Enabling it, featured in your early Debloat script utility things, but did not feature in more recent ones. It will be interesting to compare the PowerShell script in those early things with the info in this video and in the other places you referenced. A lot of good insights, heads-up, and learning potential here, IMO.
@@archpenguin6646 Just be sure to prevent your VM from getting to shared drives, of course. If you're like me, you use a component in the VM and then throw it away. I know some bad actors have actually coded to detect a VM and remain dormant (i.e., show zero malicious behavior).
@@hellhound320 Yep - allowing any third-party software to hook into your kernel is a bad idea. Organizations sell out during take overs and care zero-day about trusted relationships. Freemium options are the worst.
@@seangraylin If an MSP has all of their users across their tenants licensed for M365 Business Premium, you get Defender for Business included with that. You can then use Microsoft Lighthouse to view all threats and risks and take many mitigation actions without having to switch between different M365 admin centers.
@@victorytechnology I personally haven't used lighthouse but a few of my colleagues have and I think the opinion at the moment is that it is still lacking for now. I'd need to ask why specifically this is as like I said I haven't looked at it myself.
Microsoft Lighthouse is definitely lacking! But it’s getting better every month. It now pretty much includes all the security data that you need across all of your tenants with eligible business premium subscriptions except for vulnerability monitoring and management. You still have to login to the individual tenants security center for that. I suspect that will be coming in future releases. You can even deploy Default security base lines across all of your tenants with it. Although they are not as beefy as the security defaults that you would find in Microsoft endpoint manager.
Also the statement, "Defender will not catch as much Virusses as any other AV product, because it is more widely used" is utter hogwash. Defender reports directly into Microsoft's SOC environment in Azure, and Microsoft has invested probably more than all the other AV vendors combined in Machine Learning and Heuristics, knows their OS code better, and detects vulnerabilities quicker than anyone else on the planet currently. A typical strategy if you're looking to exploit a system / environment is to reverse engineer patches after Patch Tuesday, as reverse engineering a vulneability and attcking unpatched machines is easier trying to get to vulnearbilities by yourself. If I were to write a virus, I would rather target a smaller group / AV products and go undetected, than having to go up against all the compute in the defender backend and risk my code being flagged as suspicious and then shared with the smaller AV vendors. There are security individuals, that know alot more than Chris, that would tell you the same. If you dont want to beleive them, there is a reason why Microsoft has been in the Gartner Magic Quadrant with defender for the past 2 years.
Today I disabled Defender's real-time protection in my Windows 11 22H2 VM and, to my surprise, it still flagged a certain file. How is that possible, Microsoft!? When I disable something, I want it disabled. 100% disabled!
Kaspersky was at one time the elite, performance AV.. which is what defender is .. now over time there has been updates the issue comes to what our hours they work.. it used to be based on hashes now they all use heuristics. Nothing is perfect but from accuracy/performance trade offs.. none is perfect but I can't advocate any current third party offering over defender. It's also cloud based which means a more machines get infected, the more the system learns.. unfortunately some will systems will get infected below the radar but eventually every other system will be protected.
im not up to date. but a while back, there used to be a hacking forum how people hack into other people system and they have server out there that they want people to hack into. everytime a virus software get a new update of a virus detection, we simply just make a new one so it wont be undetected. it would be as easy as a program rewrite a new executable with the same function but a whole new code in different ways. there's really no way to protect yourself against a hacker if they focus on you. the best way is not to be connected to the internet.
Its wild to me that tech youtubers will say that Defender is great and totally fine to use by itself, and then other ones that say its a waste of space and to get it removed. Who am I supposed to listen to???
The tests I saw, it depends if Defender is working relying almost totally with online stuff or locally. If you allow all the online stuff, is powerful (less privacy of course), like other AVs, because it's using server databases and a sort of "defense net". If you use it only locally, well... That's when you are totally screwed. Other AVs, with local updates and other detection technologies, respond much better with only local usage than Defender. The tests that I saw was with the same trojans and malware in different AVs with online capabilities on and off, and the results.
Personally I don't use defender anymore since a hacker bricked my PC. The virus turned off defender and deleted my backup points. The PC was in he shop for 2 days and all data and programs was recovered.
I have a question, disabling windows defender,will it also disable our paid antivirus software like K7, Kaspersky etc... Or only the windows defender gets disabled while doing the gpedit or register ? Since I want my PC to run with paid antivirus program and not windows defender!
I was using other ways to disable it. In any case, it's not a bad antivirus for anyone who doesn't stray off the beaten path. In my case it was removing files from useful software, and Microsoft didn't even bother to properly implement the restore button for quarantined items detected as "threat", only through command line. For example it was removing IDA, which is an important code forensics tool.
I get why you would want to disable defender in a performance oriented pc, or some minimal single purpose pc with no internet connectivity... but i wouldnt advice disabling AV software for online gaming like you did, i know it can be annoying and defender is not the best but online games can ave security vulnerabilities, dark souls multiplayer and log4j in minecraft as very recent examples. So yeah, even if theres little reason to worry about an attack the probability is never zero, dont play online games without some level of protection, offline games is ok tho.
@@RTBGG Listen if you use any third party av it will be slower its just reality, i tried literally 10 of them, compared to built in even though defender can be annoying others are even worse they are just more a hog than defender.. and if you dont trust me try it by yourself.. best xp is your own xp
The question is why would you do that? Any modern security system does disable the Windows Defender (actually windows sees you’ve got another security system and let the other program to take the responsibility) and completely get rid of Windows Defender is actually not really smart even tho you only play Steam games on your machine.
@@AztekUR if we’re talking about newest versions of windows 10-11 I’m kinda sure it does not really run in background. They’re some tasks run in background these have almost no impact in performance of the machine in any way.
All these free antivirus are great but since they are free why do they require an account, Bitdefender free won't let you do anything before you create an account so it got uninstalled....
I have been working on, and with, Windows-based computers since the mid-70s. Just when you think you are up to speed and know virtually everything - Poof! It all changes. Don't be trapped within your own skull. We all only knew everything yesterday. Today? A whole new game has been coded.
@@ianwakers Nope. Its all habit. Your AV isnt stopping squat lol And yes they sell certificates for developers to bypass Defender scans, Chris did an entire video on it bud. aw.. he deleted.
so you advocate removing some protection, but you don recommend what to replace it with. I am a computer guy and there are a lot of antiviruses I don't recommend. So many of them are garbage.
watched a tech benchmark performance both before and after turning defender off and turning it off actually gave no real performance gain at all. with the exception of improving the speed at which files can be transferred fro your secondary drive to your primary drive. even then the performance gains wasn't big enough to make disabling defender worth it.
Quick question. I only use the internet for youtube and diablo and steam games download. Do I need antivirus. I'm gaming from a old Dell XPS laptop so some new games feel the lag when i'm gaming on windows 10
I have really expensive gaming rig that I only use with steam . I update windows defender / check updates every time I take a break ,3 or 4 times per 5 or 6 hours. I use my cell phone for search and discord. I have an I9 with 2080ti and 2 TB SSD what would you recommend for anyone that only boots up and plays on Steam?
Microsoft should have built in sophisticated checks for changing security settings either by the user or by granting admin privileges and tell the user when those changes happen via another sophisticated change such as a modified BSOD that allows you to to try a revert changes or click “i know”…. Something like that
Windows defender is still the best anti virus software available for windows. You can do things to add to it, but if anything were your ONLY anti virus software, it's the best one and it's free.
@@Toon1810 Chris is becoming more and more of a paid shill unfortunately, whether intentionally or not. What can you expect from just a sys admin, he cannot be the end all for OS and user space related advice. PC Security Channel does some benchmarks but he’s not even remotely all encompassing
I use a modded version of windows 11 from youtube called gost spectre, it's strips defender out along with all the bloatware, but you have to have a valid win 11 key, it has a tool box after install to add or remove windows garbage, and disables windows update, the new security updates come in the toolbox. you might want to look at it, and give your opinion.
I've got a virus trying to crack a program (I was dumb) and W Defender didn't really removed it. Malwarebytes did the job and later a full scan with Kaspersky found even more stuff, now it's my main AV and I wont ever pirate cheap stuff from YT videos
His advice with github and unknown code is why i use it in VMs. The host is to important for anything to get in. Github has useful projects and with VMs i can just make a virtual environment tailored to the project at hand. Windows Defender is useful as buying dozens if not hundreds of product keys is expensive the other way is to buy a bulk license key which most anti-malware providers don't sell unless you have an active contract with them. Most don't like VMs used in the way i use them in as it reverts back everything done to often.
Okay, I get it that window defender is not a good anti-virus if some want to attack they can...but that still raise some other questions if not Window defender then which software or technique should I use to get some kind of protection.
Most of the protection can be handled by your browser. If you download shady stuff off of the internet you can use software like sandboxie to test it or use a VM. The only scenarios where I would install an antivirus would be there where I don't have control over the machines (be it a multi-user machine or at work).
@@TurntableTV The main thing I've been using is double or triple adblockers like Adblocker Ultimate + uBlock Origin + Adblock Plus. And I've never had any issues with viruses or random things pop up or whatever. I always go to shady websites and click on random things and try to find videos or files or anything I am looking for. Then I can using the Windows Defender and nothing shows up. So now I want to test with no Windows Defender to see how my computer holds up for the next month or so. But you are correct, most issues comes from the browser, and on what people click on. So why not secure the source instead of letting crap enter your pc and then have your defender do the hard work of trying to remove it? Better block all that crap at the source, in the browser!
So you are saying that after someone aquires physical access to your personal machine running windows 10/11 pro then they can change the registry and access your computer? Or are you saying that the machine is vulnerable without physical access?
I don't like Windows. Not sure why anybody does. But man your hate fest for Windows Defender is really idiotic. Seriously. Every single flaw you've pointed out here is applicable to any other legit anti-virus package you can install on Windows. Do better Chris.
The entire antivirus market is a scam, even more so than VPNs. The public as a whole isn't very knowledgeable about cybersecurity and will just get anything branded as 'secure'
one of the things I learnt through out the years is: programs that come built in with a system are the best for the good work of that system, maybe other 3ed party programs are much better, but I rely on the built in because they are programed by the same company behind the system. so, no i won't get rid of defender, I use it and every week I download Kaspersky removal tool and scan my system then delete it.
Well not for nothing, a lot of the commands used to disable Defender could easily be turned into a security alert itself. At home, I can definitely see how dangerous this can be but when it comes to enterprise Defender is basically becoming a defacto standard in the industry and these kinds of tactics could easily be caught with proper monitoring or logging. Also, not for nothing but any other AV also could easily be targeted using similar techniques. It's certainly an issue though, especially for home users lacking any active monitoring, so thank you for raising awareness!
It's much more complicated than that if you're using Windows 11. A lot of those group policies are ignored or just temporary, it's a matter of time before they just revert, or they just straight get ignored completely. It's possible to set those policies successfully and permanently in Windows Server, but not on any client system (yes, including Enterprise, which is absurd). You can still limit defender's CPU usage to 5% and set the default taken actions for detections, so that it ignores everything, and you can also disable certain features of it, like smartscreen, you can change its priority in Image File Execution Options as well (the policy to limit the priority is now ignored, but can still be set). You may think: "well, I'll just erase Windows Defender", and that's where you're wrong. Not only Windows Defender just reinstalls itself if you use Windows 11 but, if it can't reinstall itself, you won't be able to do certain things, like updating, because, apparently, a lot of stuff passes through Windows Defender's filters before "reaching" your computer. The same thing applies to Windows Firewall. There are certain things that needs the Firewall Service to be running, otherwise they'll just think that there's no internet connection. This doesn't mean you can't disable Windows Firewall, it just means that the service of it needs to be running for those things to work properly. A third party application that needs it is Call of Duty: Warzone.
@@SpartanGR77 If you want to remove it without tampering, you may try your luck by upgrading to IoT Enterprise and checking whether the "Disable Windows Defender" policy gets ignored. If it does, try installing ClamWin or any third party antivirus and run it once and reboot, then check whether it's still ignored. This trick works on IoT Enterprise LTSC 2021 (which is based on Windows 10 21H2, though). No idea if this will work on 11 IoT.
What about %programdata%\ Microsoft\Windows Defender\Platform\? You can harden defender in gpo. Also you can force secure admin mode for changes on your machine
Microsoft quality control is unbelievably bad. One of the updates last year pushed out to the public (every win10 computer in the world!) had a memory leak in defender. Something about an older dotNET4.6 app would cause the defender executable to reliably and continually LOCK UP THE ENTIRE SYSTEM within hours. Unresponsive windows No known standard way to disable defender either, so I had to add an exception of the C drive, which they specifically say you should never do, and add the executable to defender ignorelist But if you can't trust microsoft not to blast this shit out in the future, what other option do you have than disable defender by any means possible?
Many people are not savvy with PC software like you. Windows Defender is fine as a 1st line of defence for the general populace. But anyone who wants additional protection free can consider Kaspersky Virus Removal Tool and scan manually.
Yes I totally agree. Pardon my ignorance but doesn't Winblows Defender also handle a lot of the security updates? - Will it not through updates continually try to reinstall Defender?
Chris i have a question do you think Microsoft flight simulator would work better on Linux mint? I would like to make a dual boot ssd that has fs2020 alone on that ssd along with a OS was wondering if Linux mint would be better than windows 10 or 11 ? thank you for taking time to feed back most appreciated..
Hi Chris, wondering how much exposure you've had with EDR? It's hard to see any different AV as more than a lateral move, once seeing those in action. Pretty moot for a home user of course lol.
The far greater threat is hackers. And they go after Defender more because most people use it. Nothing is risk free - it is about minimizing it on balance.
