Using dnot.sh to Replace Windows Defender

Preface

Windows Defender has basically become a street rat that everybody shouts to beat. After buying a new computer or reinstalling the system, the first thing to do is turn off this piece of junk.

Its protection capabilities aren't actually bad, but in a development environment, these situations often occur:

• Scanning large amounts of source code, dependencies, and build artifacts
• Occupying disk IO and CPU
• False-positiving some development tools, debugging tools, and KMS tools
• Automatically quarantining files
• Even when you yourself know the files are fine, you still have to restore them over and over

But this thing is getting harder and harder to turn off now, unless you install a proper antivirus, such as Huorong, which has a relatively good reputation.

I previously never really wanted to install third-party antivirus software. Even the most lightweight antivirus still takes up resources; I still prefer a clean system.

Recently I tried using dnot.sh (defendnot) to replace Windows Defender.

Project URL:

https://github.com/es3n1n/defendnot

What Is dnot.sh?

Project URL: https://github.com/es3n1n/defendnot

dnot.sh is not a real antivirus.

Its core principle is to reverse-engineer Windows Security Center, that is, the related WSC interfaces, and register itself as a third-party antivirus.

Under normal circumstances, when Windows detects a third-party antivirus, Microsoft Defender will exit active protection mode.

After installation, you can see this in Windows Security Center:

In other words, Windows already believes there is a third-party antivirus on the system.

Installing dnot.sh

Go directly to: https://dnot.sh/

Just follow the project's instructions to install.

I'll also copy the official installation instructions here

# Example 1: Basic installation
irm https://dnot.sh/ | iex

# Example 2: With custom AV name and firewall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --name "Custom AV name" --firewall

# Example 3: Without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent

# Example 4: Run once, without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent --disable-autorun

# Example 5: Uninstall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --disable

After installation, you can confirm in Windows Security Center whether dnot.sh has been successfully registered.

However, there is a pitfall here.

Windows Security Center showing that dnot.sh is enabled does not mean Defender has necessarily actually stopped running.

I ran into this situation right after I first installed it.

You can use PowerShell to check Defender status:

Get-MpComputerStatus | Select-Object `
    AMRunningMode,
    AMServiceEnabled,
    AntivirusEnabled,
    RealTimeProtectionEnabled,
    BehaviorMonitorEnabled,
    IoavProtectionEnabled

The first time I checked I got:

AMRunningMode             : Normal
AMServiceEnabled          : True
AntivirusEnabled          : True
RealTimeProtectionEnabled : True
BehaviorMonitorEnabled    : True
IoavProtectionEnabled     : True

Although Windows Security Center already showed dnot.sh, Defender was in fact still fully running.

This also explains why it would still scan and quarantine files.

Using extra-strip.bat

The defendnot project also provides:

extra-strip.bat

It is used to further disable Defender-related components, including real-time monitoring, behavior monitoring, and other features.

Run extra-strip.bat and then restart the system.

Then execute again:

Get-MpComputerStatus | Select-Object `
    AMRunningMode,
    AMServiceEnabled,
    AntivirusEnabled,
    RealTimeProtectionEnabled,
    BehaviorMonitorEnabled,
    IoavProtectionEnabled

This time the result became:

AMRunningMode             : Not running
AMServiceEnabled          : False
AntivirusEnabled          : False
RealTimeProtectionEnabled : False
BehaviorMonitorEnabled    : False
IoavProtectionEnabled     : False

This is what indicates that Defender has truly stopped running.

So from actual use, it can be simply understood as:

dnot.sh
    ↓
向 Windows Security Center 注册第三方 AV

extra-strip.bat
    ↓
进一步关闭 Defender

最终结果
    ↓
Windows Security Center 显示 dnot.sh
Defender 不再运行

Final Result

After completing the configuration, Windows Security Center will still believe the system has security software, so it will not keep prompting “no antivirus installed.”

At the same time, Defender itself no longer performs real-time scanning.

For people who do not want to install third-party antivirus software, and also do not want Defender constantly scanning their development environment, this approach is relatively lightweight.

However, it should be noted: dnot.sh itself has no virus-scanning capability.

In other words, after using this approach, it is essentially equivalent to the system running naked.

Therefore, whether it is suitable to use depends on your own usage habits and security needs.

For ordinary users, I do not recommend turning off Defender.

But if you are fairly clear about the sources of the programs you run, and can also judge the safety of executables, scripts, and development tools yourself, then dnot.sh counts as a relatively clean solution.

Summary

The whole process is actually quite simple:

1. Install dnot.sh
2. Confirm that Windows Security Center has recognized dnot.sh
3. Use Get-MpComputerStatus to check Defender status
4. If it still shows Normal, run extra-strip.bat
5. Restart Windows
6. Confirm again that AMRunningMode = Not running

At least on my current Windows 11 machine, I was ultimately able to replace Windows Defender with dnot.sh.