Windows 10: Can anyone explain why admin cant kill windefend service?

Hi!

How do I kill current scan on my computer? All I can ever find in the internet is how to stop windows defender completely, but is there a way to stop the service just temporarily? It's gone in some infinite loop and scanning status is not even showing up in windows defender UI so there is no button to cancel it. Currently I dont want to reboot either.

If I run cmd as admin and type sc stop I get this:
C:\Windows\system32>sc stop windefend
[SC] OpenService FAILED 5:

Access is denied.

Can anyone tell how can service be immune to admin rights? I mean I know that kernel can protect itself from user mode process killing, but does windefend service run in kernel mode or is it just some clever permissions trick?

Current windows version: Version 10.0.17134.165

:)

 

What is WinDefend?

Sorry but we are talking about services, and believe it or not, the legit Windows Defender service (Microsoft anti malware that is shipped with Windows Vista, and later, on install) is called WinDefend. And if you don't believe me, try running it yourself: Code: sc start WinDefend[/quote] If you don't want it running (or you have another anti-virus solution running), launch a command prompt in admin mode and do this:
Code: sc config WinDefend start="disabled" sc stop WinDefend[/quote] Good luck.

 

What is WinDefend?

[/quote]If you don't want it running (or you have another anti-virus solution running), launch a command prompt in admin mode and do this:
Code: sc config WinDefend start="disabled" sc stop WinDefend[/quote] Good luck. Click to expand... That worked, thanks. I'll reboot and see if it stays. Should I be running it or not?

 

What is WinDefend?

Windows Defender can't be started from the "Run" thingy like any other program, it's a service, if you want to start it on your brothers computer you need to run Code: sc start WinDefend[/quote] on an admin command prompt.