This will disable or enable Windows Defender as easily as uncommenting the correct command and commenting out the opposite.

• Under Evaluation Code:

If (Test-Path "$env:allusersprofile\SoftwareDistribution")

{

Exit 0



}

Else {

Exit 1

}

• Under Remediation Code:

#To disable real-time monitoring of Windows Defender, run the following command:



Set-MpPreference -DisableRealtimeMonitoring $true



#To enable real-time monitoring, comment out the $true statement above then uncomment and run the following command:



#Set-MpPreference -DisableRealtimeMonitoring $false