Skip to main content

Disable Defender System Guard

Overview​

About this category

This category contains privacy scripts for Windows.

These changes use Windows system commands to update your settings.

This category disables Defender System Guard, a security feature in Windows.

This feature is referred to as Windows Defender System Guard 1 2, System Guard 3, and internally within Microsoft as Octagon 4. Introduced in Windows 10, version 1709 1 4, it is a set of system integrity features 1 2.

System Guard acts as an anti-tampering mechanism 4. It is a Windows component that protects system integrity during startup and runtime 1 2 3. It is included as part of the Defender for Endpoint suite 2.

It features:

  • System Integrity Protection:
    • Protects and maintains system integrity during startup and runtime 1 2 3
    • Validates system integrity through local and remote verification 1 2 3
    • Ensures only signed and secure Windows files and drivers can start 1 2
  • Critical Resource Protection:
    • Safeguards critical resources (e.g., authentication stack, biometric stack) 2 3
    • Protects against System Management Mode (SMM) attacks 3
  • Hardware-Based Security:
    • Uses hardware-based security features to prevent unauthorized software from running before Windows starts 1 3
    • Takes integrity measurements during boot using TPM 2.0 2 3
  • Remote Management and Analysis:
    • Enables remote analysis of device integrity 1 2
    • Allows management systems (e.g., Intune, SCCM) to acquire integrity data 1 2 3
    • Enables remote actions (e.g., denying resource access) for compromised devices 1 2 3
    • This capability works by sending system integrity data to the Microsoft cloud and other third parties 5.

Disabling System Guard enhances privacy by preventing remote analysis of your system. It also gives users more control, allowing changes to system components that are normally protected. This enables privacy modifications that require system-level changes, such as disabling other Defender features.

However, disabling System Guard may reduce overall system security. It removes safeguards that prevent unauthorized system changes and malware infections during startup. This may increase your system's vulnerability to attacks. Using this on a work or school computer may violate organizational policies.

Caution

This action may expose your system to increased security risks.

Not Advised

This category should only be used by advanced users. None of its scripts are recommended for daily use as it breaks important functionality. Do not run it without having backups and system snapshots.

Apply now​

These scripts are written using Batch (batchfile) scripting language.

Choose one of two ways to apply:

  1. Automatically via privacy.sexy: The easiest and safest option.
  2. Manually by downloading: Requires downloading a file.

Alternative 1. Apply with Privacy.sexy​

privacy.sexy is free and open-source application that lets securely apply this action easily.

Open privacy.sexy

It allows selectively choose parts of this action to conduct. You can fully restore this action (revert back to the original behavior) using the application.

privacy.sexy instructions
  1. Open or download the desktop application
  2. Search for the category name: Disable Defender System Guard.
  3. Check the category by clicking on the checkbox of the category.
  4. Click on Run button at the bottom of the page.

Alternative 2. Download​

Consider restarting your computer for all changes to take affect.

Reversible

This action is completely reversible, you can restore your changes to the initial/default state. The restore/revert methods provided here can help you fix issues.

If something goes wrong, use the Revert script provided above.

All​

This script includes Standard, Strict recommendation levels along with unrecommended scripts.

Not Advised

This script should only be used by advanced users. Some of these changes are NOT recommended for daily use as it breaks important functionality. Do not run it without having backups and system snapshots.

Download all scripts:

Download script

Restore these changes if you decide to revert them by downloading the restore script:

Download restore script

Explore further​

This category includes total of 6 scripts but no subcategories.

Explore its 6 scripts:

Disable System Guard startup verification

This script disables System Guard Secure Launch, a security feature in Windows. Secure Launch is also known as Virtualization Based Security (VBS) or firmware protection. This feature enhances startup security on Windows systems. It was initially introduced in Windows 10 version 1809. It protects the Virtualization Based Security (VBS) environment from vulnerabilities in device firmware. VBS, in Windows, refers to a security technology that uses hardware virtualization to...

Disable System Guard sandbox monitoring

This script disables the System Guard Runtime Monitor LPAC (Least-Privileged AppContainer) process. This process is part of the System Guard Runtime Monitor (SGRM) functionality. SGRM is a Windows security feature that monitors the system for potential tampering. • LPAC (Least-Privileged AppContainer) means this component operates in a restricted environment for enhanced security. Its exposes information through: RPC allows different software programs to communicate, even if they...

Disable System Guard kernel monitoring

This script disables the System Guard Runtime Monitor Agent, a kernel driver within Windows' security infrastructure. The System Guard Runtime Monitor Agent is a kernel-mode component of System Guard that runs in the Secure Kernel. The Secure Kernel operates in a more secure and isolated environment called "VTL1" (Virtual Trust Level 1), while the normal NT kernel runs in a virtualized environment called "VTL0". This separation adds another layer of security. It provides essential fu...

Disable System Guard communication hub

This script disables the System Guard Runtime Monitor Broker service and its associated process. The System Guard Runtime Monitor Broker service monitors and verifies Windows platform integrity. It handles attestation and reporting functions. It assists assertions of System Guard Runtime Monitor (SGRM). This enables management systems such as Intune and SCCM to collect integrity data. It supports remote actions such as blocking access to compromised devices. The service manag...

Disable System Guard rule definitions

This script disables System Guard security checks, also called assertions. System Guard assertions are measurements of sensitive system properties in real time. They help detect subtle security threats by assessing the system's security. However, this monitoring may compromise privacy by sharing system health data with external services. This script enhances privacy by preventing the sharing of system health data. It may also improve performance by reducing the overhead from security checks....

Disable System Guard rule scanner

This script disables the Secure Enclave, a component of the System Guard feature in Windows. The Secure Enclave is also known as the assertion engine. It continuously monitors and checks system integrity during runtime, assessing the system's security state. It is a core component of System Guard. This engine can send collected data to cloud or third-party providers. This script enhances privacy by preventing system integrity data from being shared externally. It may also imp...

Explore Categories​

This action belongs to Disable system modification restrictions category. This category disables features that restrict system modifications in Windows. This enables deeper system modifications, enhancing privacy by allowing the removal or disabling of data-collecting components like Defender. These features raise several concerns: Less user control: • Users can't... Read more on category page ▶

Support​

This website relies on your support.

Support now

Your donation helps keep the project alive and improves its content ❤️.

Share this page:

EmailLinkedInRedditPinterestWhatsAppTelegramWeiboVK