Windows 10 Defender lab checklist
The .PS1 files are the procedure. Run those files. This note is not a second copy of the registry loop.

This is a lab procedure for a Windows 10 virtual machine you control. It is not a Microsoft-supported configuration. Take a hypervisor snapshot named pre-defender-disable before the first change. If Safe Mode stays black, or the guest will not leave Safe Mode, revert that snapshot.

Do not change SecurityHealthService. The scripts never write it. Do not add webthreatdefsvc or webthreatdefusersvc. Those services are not part of Windows 10. Leave SmartScreen and the firewall alone. Windows 10 has no Smart App Control.

1. Normal session, local admin. Turn Tamper Protection off when the switch exists. Turn real-time protection off on the same page. Real-time protection may turn itself back on. The service change is what sticks.
2. Optional, and not on Windows 10 Home. Open gpedit.msc. Set "Turn off Microsoft Defender Antivirus" (older builds say "Turn off Windows Defender Antivirus") to Enabled. Set "Turn off real-time protection" to Enabled. Do not reboot into a normal session for the policy alone. The next reboot is into Safe Mode.
3. Elevated Command Prompt, not PowerShell. In PowerShell, {current} is a script block.
   bcdedit /set {current} safeboot minimal
   bcdedit /enum {current}
   shutdown /r /t 0
   The enum must show safeboot Minimal before the reboot. If it does not, do not reboot. Alternate path: msconfig, Boot, Safe boot, Minimal, Restart.
4. In Safe Mode, elevated PowerShell. OptionValue 1 under HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Option means Minimal Safe Mode. No key means a normal boot. Process-scope execution policy only:
   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
   .\Disable_Defender2.PS1
   RESULT: PASS means every required Start value is 4, Sense is 4 or missing, and every returned task is Disabled.
   A WARNING that no tasks were returned is expected when Safe Mode has not started Task Scheduler. That warning is not the final pass.
   RESULT: FAIL means do not continue. A denied Start write for WinDefend, WdFilter, WdBoot, WdNisSvc, or WdNisDrv stays a failure until a later run prints RESULT: PASS.
5. Leave Safe Mode from an elevated Command Prompt.
   bcdedit /deletevalue {current} safeboot
   bcdedit /enum {current}
   shutdown /r /t 0
   safeboot must be absent before the reboot. If msconfig was used, clear Safe boot there instead.
6. After the normal desktop is up, elevated PowerShell:
   .\Check_Defender_Disabled.PS1
   The final gate is RESULT: PASS from that script, and its exit code is 0 only for that result.
   Safe Mode, a running MsMpEng.exe, a loaded WdFilter, a WdNisDrv START_TYPE other than 4, or an empty task list each fail the check.
   Win32 exit 1077 means the driver was not started this boot. It does not prove Start is 4. A Manual driver that nothing started prints the same exit code.
   Get-MpComputerStatus is non-authoritative. The script catches a throw from that cmdlet and still prints the later results.
   driverquery matches are installed drivers. A match is not a failure.

If the check fails because Start is not 4, MsMpEng.exe is running, WdFilter is loaded, or Safe Mode is still set, run Disable_Defender2.PS1 again from Safe Mode. A normal-desktop rerun cannot write Start while WdFilter is loaded.
If every START_TYPE is already 4 and the only failure is task State, run Disable_Defender2.PS1 again on the normal desktop. A name that is already 4 is left unchanged.

Undo with Restore_Defender.PS1 and Restore_Defender_Windows10_Enterprise.pdf.
The pre-reboot run writes Start and does not enable tasks. Do not start WinDefend before the reboot.
After that reboot, wait until the desktop has been up for a minute, then run:
.\Restore_Defender.PS1 -AfterReboot
An empty task list on that run is a failure. WdNisDrv must read back as START_TYPE 3. WdFilter and WdBoot must read back as START_TYPE 0.
RESULT: PASS on that run does not turn Tamper Protection or real-time protection back on. Those switches are still manual.
If an older note set SecurityHealthService to 4, set that one value back to 3 by hand. The current scripts do not write it.