Microsoft has confirmed that they no longer allow Microsoft Defender to be disabled via the Windows 10 Registry to support the Tamper Protection security feature. Microsoft Defender will only be disabled when done so via Windows settings or when another antivirus software is installed. BleepingComputer believes that Microsoft removed this policy not only as it is not needed, but also to prevent attackers from exploiting this brief hole in Tamper protection. With the DisableAntiSpyware Registry value removed, malware can no longer exploit the weakness in Microsoft Defender.
Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-why-windows-defender-can-t-be-disabled-via-registry/

