Remove Microsoft Defender Update on Windows 10 & Server

Microsoft Defender Antivirus is also referred to as the “Endpoint Protection” and it is a free malware protection software that comes pre-installed on Windows 10. In this article, we will discuss “Remove Microsoft Defender Update on Windows 10 & Server”. Previously called Windows Defender, Microsoft Defender Antivirus provides effective but no-frills real-time anti-malware protection for individual devices. See the following guide on how to set up a VM via PXE boot on a Generation 1 VM, and how to set up a VM via PXE boot on a Generation 2 VM.  

If you are using a non-Microsoft antivirus/antimalware product on your device, you might be able to run Microsoft Defender Antivirus in passive mode alongside the non-Microsoft antivirus solution. This depends on the operating system used and whether your device is onboarded to Defender for Endpoint.

Microsoft Defender Antivirus is activated by default if no other active antivirus software is detected, and automatically activates when third-party antivirus protection is disabled. Microsoft Defender is part of Microsoft’s Windows Security settings.

To remove the installed (updated Microsoft Defender Antivirus) update from the Windows 10 image (install.wim), please follow the steps below.

You may want to see “how to update Microsoft Defender Antivirus into the install image of Windows (install.wim)“, and “how to view Microsoft Defender Antivirus update details on Windows 10 image (install.wim)“.

Remove Microsoft Defender update on Windows Image

In order to remove in installed (updated Microsoft Defender Antivirus) update from the Windows 10 image (install.wim), please follow the steps below. Launch PowerShell with administrative privilege by right-clicking on it as shown below.

Type the following command to open the directory with the extracted files and hit enter. In the below command, make sure to specify the path of the folder with the extracted files. This command will open the folder with the extracted files.

cd PATH\TO\THE\DEFENDER-UPDATE-KIT
cd C:\Users\Christian\Documents\defender-update-kit-x64

Type the following command to rollback the Microsoft Defender Antivirus to its previous version and press Enter:

.\DefenderUpdateWinImage.ps1 -WorkingDirectory "DEFINED_TEMP-LOCATION" -Action RemoveUpdate -ImagePath "PATH\TO\INSTALL.WIM"
.\DefenderUpdateWinImage.ps1 -WorkingDirectory "C:\Users\Christian\Documents\Windefprocess" -Action RemoveUpdate -ImagePath "C:\Users\Christian\Documents\Image\install.wim"

In the command, replace the “DEFINED_TEMP-LOCATION” with the path to a folder that the script will use for the process, and make sure to enter the “PATH\TO\THE\INSTALL.WIM”.

You have just updated in this guide “how to update Microsoft Defender Antivirus into the install image of Windows (install.wim)“. When you run the script, the operation will mount and remove the installed update. It then dismount it again as shown below.

Once the steps are complete successfully (as shown below). The script should remove the recently applied antivirus update on the Windows system you have specified in the command.

I hope you found this blog post on how to remove Microsoft Defender update on Windows helpful. If you have any questions, please let me know in the comment session.