Need help with Group Policy Editor from IT pro

Richard1943 · 17 Jul 2022

I'm running a stable version of Win7 Pro virtually on Ubuntu 22.04 QEMU-KVM. I have Windows Security Essentials installed. Unfortunately, I have Windows Defender also installed. I want to turn off WD but have been unable. If I disable it in Services, it still starts up at log on with message "Service Stopped". I tried the script Windows_Uninstaller but no luck; it finished with errors. I opened Options/Administrator within WD but the checkbox "Use this program" is checked and, greyed out. Sheesh, I'm the only user on this PC! It appears that Local Group Policy Editor contains the solution to un-grey the "Use this program" checkbox. Although I've used windows since the early 1990s I have never used the LGPE and there must be 800 different settings available. I've toasted enough OSs to know better to muck around with settings I don't completely understand. So, I'm hoping there's a Windows IT expert who can tell me what setting in LGPE I need to change to take complete control of WD and uncheck the "Use this program" box. I'm comfortable using the command prompt (cut my PC teeth on CP/M) if that's an easier way to get the "Use this program" checkbox unchecked.

SIW2 · 17 Jul 2022

Does it show under the startup tab in msconfig ?

Richard1943 · 18 Jul 2022

No, Windows Defender does not show up in startup tab in msconfig.

SIW2 · 18 Jul 2022

Delete All Group Policy Registry keys

========================

1. Click “Start”, type “regedit.exe” (without quotation marks) into “Search” box and press Enter.

2. Locate the following key:

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft]

Right click on "Microsoft", click "Export"; please name the file as "RegBackup" (without quotation marks) and then save it to the C:\ drive as a backup.

Note: In case we need to undo the modification, we can double click this RegBackup.reg file to restore the registry key.

3. Highlight Microsoft and click "Delete".

4. Please repeat the above steps for the following registry keys.

[HKEY_CURRENT_USER\Software\Policies\Microsoft]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

Note: if some keys do not exist, please ignore them.

3. Exit the Registry Editor.

thak you so much i did the "Delete All Group Policy Registry keys" and it worked

Error message trying to start Windows defender

Hopefully when you have got rid of whatever is in those policy keys, MSE will turn off Defender.

Richard1943 · 25 Jul 2022

It worked! Problem gone.

SIW2 · 25 Jul 2022

file3456 · 26 Jul 2022

I was initially thinking it had something to do with QEMU and writing permissions and what have you in that type of virtual environment. I also think QEMU is an emulator and not a true virtual machine, but I'm not sure. Been a long, long time since I messed with it. I'm sure by now it's matured greatly.

I'm also thinking you could modify your Windows 7 version with NTLite before it's installed in QEMU.

This program might be of future interest. GitHub - Fleex255/PolicyPlus: Local Group Policy Editor plus more, for all Windows editions

GitHub - Fleex255/PolicyPlus: Local Group Policy Editor plus more, for all Windows editions

Don't those registry keys wipe out GPO altogether or just defaults the policies?