This will disable or enable Windows Defender as easily as uncommenting the correct command and commenting out the opposite.
• Under Evaluation Code:
If (Test-Path "$env:allusersprofile\SoftwareDistribution")
{
Exit 0
}
Else {
Exit 1
}
• Under Remediation Code:
#To disable real-time monitoring of Windows Defender, run the following command:
Set-MpPreference -DisableRealtimeMonitoring $true
#To enable real-time monitoring, comment out the $true statement above then uncomment and run the following command:
#Set-MpPreference -DisableRealtimeMonitoring $false
