XenonKilla

Yeah I was pretty disappointed when PsExec didn't work when trying to run commands on a LOCAL computer without an active network connection. Then RunAsSystem looked promising but clearly lacks the ability to pass arguments to the process it's opening. But NirCmd definitely seems to do the trick just fine

FINALLY! NirCmd did the trick! nircmdc runassystem reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001Out of all the dam registry tweaks I have in my script, this stupid Windows Defender key is the only one to give me trouble. You would expect the UAC key to have the same issues but of course that one can be modified with no issues lol. Now hopefully I don't run into any other issues like I did with PsExec Thanks to everyone for their help and especially jaclaz for suggesting NirCmd. As many NirSoft programs as I have saved on my computer, I completely forgot about NirCmd

Yeah I'm using VMware Workstation to test. I'm working with a clean install of Windows 7 x64 and NOTHING modified. UAC enabled etc etc. I'm simply trying to disable Windows Defender with a batch script so that I can implement it into my "Tweaks" script that I've made. If I open a command window (as admin) and run this... RunAsSystem cmd This obviously opens a new command window as SYSTEM. So now if I run my reg script reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001 Then everything works great. Registry value gets changed and Windows Defender is now Disabled. So obviously I know RunAsSystem can get the job done, however the hard part is getting this to work in a batch script. When I say it doesn't work, I simply mean that everything executes as expected, however, the registry value just never gets changed. I've tried this... From a command window (as admin)RunAsSystem reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001No errors are given and everything executes as expected, however, the DisableAntiSpyware value isn't changed. I've also tried this... From a command windows (as admin)RunAsSystem test.bat(test.bat)reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001Once again no errors are given and everything executes as expected, however, the DisableAntiSpyware value isn't changed. And lastly, per your suggestion, I tried compiling with BATtoEXE (which I already use regulary BTW) and I got the same results as running with test.bat

Well I tried creating TWO bat files. My first one uses this command... test1.bat RunAsSystem test2.battest2.bat reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001This didn't work either. So I guess RunAsSystem won't work for this situation then. If it only opens the process but doesn't pass any parameters to the process then it's pretty much useless for this situation. At the very most I would have to launch the cmd process from my original batch file and then manually type the reg add command. Ideas?

Yeah I tried that before and upon your suggestion I tried it again, however, I'm having the same issue as the first time I tried which is that I can get it to launch a command window as SYSTEM, however, I cannot get it to pass a command to that new command window with the same batch script. Here's what I've tried... RunAsSystem reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001RunAsSystem cmd /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001If I use RunAsSystem to launch a new command window and then run my reg add it works just fine. But I'm trying to get this all to run automatic without any user intervention.Ideas?

Looks like I spoke too soon. I just discovered an issue today when I was rebuilding a system and doing an OS install from scratch. My script worked fine however PsExec would not run because the computer didn't have a network connection enabled. The computer has a network controller however the drivers weren't installed yet so this was causing PsExec to throw this error... I was running the exact code I listed above locally so I dunno why it would throw this error. I'm assuming it just has something to do with the way PsExec works being that it's a tool targeted for running commands on remote systems rather than locally. I dunno if there is a workaround for this or if I just need to search for a new tool or what. Any ideas?

I recall many times where I start a thread and figure out the answer before posting. Sometimes, going over the problem whether typing it out or talking to someone, will put some new idea in your brain and sometimes that is all you need. I know right! I ALWAYS make sure to post as a very last resort. I searched for almost 2 hours and was like OK I'm just gonna post up and see if anyone knows. Then I posted and decided to hit Google a little bit more and finally came across what I needed

Figures, I spent like 1.5hrs trying to get this to work and no sooner than I create this thread I figure it out Well just in case anyone runs across this via search in the future, turns out you have to use DE instead of D but for some reason the Icacls reference page doesn't show there being a DE parameter. icacls MyFolder /deny Administrators:(oi)(ci)(de,dc)

I'm trying to set deny "delete folder" and "delete file" permissions on a folder and all of it's contents. So far here is what I have come up with... icacls MyFolder /deny Administrators:(oi)(ci)(d,dc)This sets the deny permissions correctly however I cannot even access the folder after setting permissions this way. If I set the deny permissions manually then it works fine. Any ideas?

Worked great!! Thanks!! Here is what I ended up with... PsExec -accepteula -s reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f /v DisableAntiSpyware /t REG_DWORD /d 00000001

I've got a registry script I made that I run after every new clean install of Windows which makes several changes to the OS enables/disables features, tweaks the interface etc. I've got ALL my tweaks in the file working EXCEPT the Disabling of Windows Defender. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]"DisableAntiSpyware"=dword:00000001I know this isn't working due to a permissions error being that the Windows Defender key is owned by SYSTEM and Administrators or User don't have sufficient privileges. So I'm in search of how to script around this issue. I was thinking perhaps using regini or subinacl to change the permissions of the key and they run the reg file but I can't seem to come up with anything that works. Any ideas?