Thomas' Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== Removing Microsoft Defender from a Mac ======

After installing Microsoft Defender on a Mac, it prevents itself from being deleted. The mechanism on how it does so is still unclear to me, but you cannot delete the Defender app, even as root. In order to delete it, you first need to disable its anti-tamper protection:

<code bash>
sudo mdatp config tamper-protection enforcement-level --value audit
</code>

Then, you can properly remove the app by issueing the following command:

<code bash>
sudo /Library/Application\ Support/Microsoft/Defender/uninstall/uninstall
</code>

Do note that disabling the tamper-protection will log an event in Microsoft Defender. Your security team may question you about this.

You can also check then current status of the tampering protection using the following command:

<code bash>
mdatp health | grep "tamper_protection"
</code>

If it says ''blocked'', tampering protection is enabled. If it says ''audit'', then the app can be tampered with.

{{tag> Defender}}