Windows Defender & Firewall Repair Tool
Restore Windows security components after privacy tools have disabled them

DefenderShield is a comprehensive repair tool designed to restore Windows Defender and Windows Firewall after they've been disabled by privacy tools like privacy.sexy, O&O ShutUp10, Windows debloaters, or manual registry modifications.

Many users run privacy scripts to reduce telemetry but accidentally disable critical security components. DefenderShield reverses these changes with a simple GUI interface, letting you choose exactly which components to restore.

• Restores firewall service registry configurations
• Removes Group Policy blocks
• Enables all firewall profiles (Domain, Private, Public)
• Resets firewall to default settings
• Starts dependent services in correct order (BFE → mpssvc → IKEEXT → PolicyAgent)

• Restores all Defender service registry keys
• Removes 20+ known disabling registry values from Policy and direct paths
• Repairs Defender driver configurations (WdFilter, WdBoot, WdNisDrv)
• Re-enables disabled scheduled tasks
• Detects and removes malicious scheduled tasks that re-disable Defender
• Checks for and removes WMI event subscriptions targeting Defender
• Resets local Group Policy blocking Defender
• Re-registers Windows Security UWP app
• Enables all protection features via Set-MpPreference
• Triggers signature update

• Selective Repair: Choose to repair Firewall only, Defender only, or both
• System Restore Point: Optionally creates a restore point before making changes
• Comprehensive Logging: Detailed log saved to Desktop
• Registry Backup: Backs up registry keys before modification
• Error Resilient: Continues execution even if individual operations fail
• Auto-Elevation: Automatically requests administrator privileges

Main Interface

• OS: Windows 10 / Windows 11
• Privileges: Administrator
• PowerShell: 5.1 or later (included with Windows)

1. Download DefenderShield.ps1 from the Releases page
2. Save to a convenient location (e.g., Desktop)

1. Right-click DefenderShield.ps1
2. Select Run with PowerShell
3. If prompted by UAC, click Yes

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force
.\DefenderShield.ps1

1. Select components to repair using the checkboxes:

   • ✅ Windows Firewall
   • ✅ Windows Defender Antivirus
   • ✅ Create System Restore Point (recommended)

2. Click Start Repair

3. Watch the status output for progress

4. When complete, click Restart PC (recommended)

If Windows Defender won't start after repair, you may need to:

1. Open Windows Security
2. Go to Virus & threat protection → Manage settings
3. Turn OFF Tamper Protection
4. Run DefenderShield again
5. Turn Tamper Protection back ON

Tamper Protection is a security feature that prevents programs from modifying Defender settings. While it protects against malware, it also blocks legitimate repair tools.

The tool removes/resets these common blocking values:

Policy Keys (HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\...)

• DisableAntiSpyware
• DisableAntiVirus
• DisableRealtimeMonitoring
• DisableBehaviorMonitoring
• DisableOnAccessProtection
• DisableIOAVProtection
• DisableScanOnRealtimeEnable
• And more...

Direct Keys (HKLM:\SOFTWARE\Microsoft\Windows Defender\...)

• Same values as above in the non-policy locations

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force

• Restart your computer after running DefenderShield
• Check if Tamper Protection needs to be temporarily disabled
• Some deep modifications require Safe Mode to fully reverse

1. Ensure Tamper Protection is OFF
2. Run DefenderShield again
3. Restart computer
4. Check Windows Security app

• Ensure no third-party firewall is installed (they often disable Windows Firewall)
• Check if antivirus software is managing the firewall

• ✅ No data collection - Everything runs locally
• ✅ No network requests - Except Windows Update signature downloads
• ✅ Open source - Full source code available for review
• ✅ Creates backups - Registry exported before changes
• ✅ Restore point - Optional system restore point creation

Contributions are welcome! If you find a privacy tool that breaks Defender/Firewall in a way DefenderShield doesn't fix:

1. Note the exact tool and settings used
2. Check which registry keys were modified
3. Open an issue with the details

This project is licensed under the MIT License - see the LICENSE file for details.

This tool modifies Windows system settings and registry values. While it creates backups and is designed to be safe:

• Use at your own risk
• Always have backups of important data
• Test in a VM first if unsure
• The author is not responsible for any issues arising from use of this tool

• Inspired by the need to help users who went too aggressive with privacy tools
• Thanks to the privacy.sexy project for documenting what registry keys control Windows security features

Made with ☕ by Matt