Antimalware service executable eats memory

Anonymous
2025-02-04T08:12:19+00:00

title. it's always taking 200-300 mb of memory.

I tried:

disable windows security, got hit with this setting is managed by your (non existent) administrator

end task, got access is denies

command prompt things, did nothing

edit group policy, did nothing

enable disableantispyware in regedit, got hit with access is denied

tried to give myself permission to enable disableantispyware, access is denied

in case I missed any, I basically tried everything you can find online. no matter what I do, either nothing happens, access is denied or this setting is managed by your administrator

I'm about to flip this is my computer, I should get to choose what to do. I am the administrator and only user

Windows for home | Windows 10 | Settings

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

61 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Ramesh Srinivasan 87,865 Reputation points Independent Advisor
    2025-02-06T05:18:30+00:00

    You can type:

    bcdedit

    Then, note the partition number mentioned in the output. Look for the output that contains the line "osdevice"

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-02-06T05:15:27+00:00

    I can't type the bcdedit line because in winre command prompt my | key types #, I tried every button possible nothing works. also I clicked 'skip this drive' when it asked for some key?? because idk what the key is, that's ok right

    Was this answer helpful?

    0 comments
  3. Ramesh Srinivasan 87,865 Reputation points Independent Advisor
    2025-02-06T04:57:04+00:00

    Ok. Please copy the following lines to Notepad:

    ******* 

    reg delete "HKLM\SO2\Microsoft\Windows Defender\Features" /v SenseEnabled /f
reg delete "HKLM\SO2\Policies\Microsoft\Windows Defender" /f
reg add "HKLM\SY2\CurrentControlSet\Services\Sense" /v "Start" /d "4" /t REG_DWORD /f
reg unload HKLM\SO2
reg unload HKLM\SY2

    *******

    Save the file as "sense.bat". Use double-quotes around the file name to avoid double extensions when saving it.

    Copy the file to the C:\ root directory. (i.e., C:\Sense.bat)

    Access WinRE. To do so, click Start, Power. Press and hold Shift while clicking Restart.

    It takes you to WinRE. Click Troubleshoot → Advanced Options → Command Prompt.

    Type:

    bcdedit | find "osdevice"

    Note the OS partition's drive letter from the output.

    Suppose it's C:\

    Run:

    *******

    reg load HKLM\SO2  C:\Windows\System32\Config\SOFTWARE

reg load HKLM\SY2  C:\Windows\System32\Config\SYSTEM

C:\sense.bat

    *******

    If possible, take photos of the output screen using your mobile phone or camera and share the images here.

    Restart the system.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-02-06T04:22:07+00:00

    yeah, it USED to be a school computer but now it's a different account and now the school account has been deleted from the computer and the account is locked so I can not sign in

    Was this answer helpful?

    0 comments
  5. Ramesh Srinivasan 87,865 Reputation points Independent Advisor
    2025-02-06T04:14:11+00:00
    1. The boot log is corrupt.
    2. The Sense service (Defender Advanced Threat Protection) is enabling those policies again. I understand this is a standalone system. But if the system was once part of a domain network, ATP may have been configured. If that's the case, the best option is to offboard the device via the Microsoft portal.

    https://learn.microsoft.com/en-us/defender-busi...

    1. If the UAC dialog appears again, click "Show more details" and note the process name Post the info here.

    We may be able to turn off the ATP service via Windows RE but I'd try option #2 first.

    Was this answer helpful?

    0 comments