Disable Defender
Purpose
This solution disable the defender if the supported other AVs are detected and running.
Associated Content
| Content | Type | Function |
|---|---|---|
| cPVAL Supported AV Services | Custom Field | This custom field will require the list of AV that are active and running; if found, then the Defender gets disabled. Provide the value of AVs in a comma-separated list within the single quotes. For example: SentinelAgent,AnotherAVService |
| Disable Defender Vs Supported AV | Script | This script will disable the defender if the supported AVs are found and running. |
| Disable Defender - Workstation | Compound Condition | This compound condition will run the script Disable Defender Vs Supported AV on workstations and creates a ticket if it fails to disable Defender. |
| Disable Defender - Server | Compound Condition | This compound condition will run the script Disable Defender Vs Supported AV on servers and creates a ticket if it fails to disable Defender. |
Implementation
- Create the Custom field - CPVAL Supported AV Services
- Create the Script - Disable Defender Vs Supported AV
- Create the Compound Condition - Disable Defender - Workstation
- Create the Compound Condition - Disable Defender - Server
- The compound conditions will trigger the automation Disable Defender Vs Supported AV every 24 hours and will create the ticket if it fails to disable the Defender.
Changelog
2026-06-17
- Initial version of the document