Windows – Disabling Microsoft Antimalware service

@richard states:

If Process Explorer is unable to kill the process ... then it is really unkillable.

Not correct, there are certain processes I couldn't kill with Process Explorer but with other tools like rootkitunhooker.exe.

Also Process Explorer does not show RootKit processes, so it also can not kill them.

I usually use the "psexec -s" approach.

pskill.exe may not work within psexec -s, but I have described a workaround for that.

I believe the command you are looking for is:

sc config servicenamehere start= auto

You'll need to know the name of the service though - to view this from the command line, try this command - this will show all services:

sc query type= service state= all

If you want to see only stopped services, run this command:

sc query type= service state= inactive

The list of services output by the query can be quite long. You may filter it by using findstr (see post here) . For example

sc query type= service state= all | findstr "ssh"

Will select the output lines of the services list that contain the string "ssh"

Note: For some services you may need also administrator privileges, you will notice it on getting the message Access is denied after executing the sc command. In that case open the Command Prompt (Admin) by pressing 'Windows + X' keys.