Reversing changes done to Security subsystem

[hellodears]

How do we reverse the changes this thing does after 'disabling' Windows Defender (which it does not do, but instead just disables the UI so now we can't access defender or the security settings AT ALL). Switching all the settings back to their original positions does zero. We're basically forced to do an inline reinstall of the OS.

[Greedeks]

The result is a change of rights in the registry. This results in an inscription like "access is restricted by the administrator". Windows Defender works, but the user is limited in its settings.
My mistake is that I didn't mention it in the description. But still, it's not for nothing that I made the start page - More. To create recovery points, although I understand that some people don't need them or they don't want to clog up the disk.
I apologize for the inconvenience, and I will fix this issue in the next update.

Upd.
Solved

As for the UI, it will not be available when Windows Defender is turned off. The utility does not just stop it, but stops and turns off it and related services. Just a regular one is most likely suitable for you.the bat file for stopping WD.

[hellodears]

We're now testing in a VM (Windows 11 24H2). Indeed, the UI is now returned properly when the option is toggled. However, Defender is never actually "disabled" in any case. After reboot, the OS immediately re-enables defender in the background, so even though the UI is unavailable, defender AV continues to function normally. We can test this by attempting to copy a known malware onto the desktop. Defender continues to detect and remove it... We can see in Gtweak (after reboot) that the option/tweak is also automatically shown re-enabled.

[Greedeks]

@hellodears Could you specify the Windows edition? In my tests, when using Windows VM (24H2) Pro and Home, this behavior was in case of incomplete installation of drivers and updates. At the same time, it was corrected by turning on the tweak again and then turning it off.
All this is solved, of course, by banal violent methods against Windows Defender files. But I am not in favor of that, I would like to decide not so radically.

[hellodears]

"ver" reports "Microsoft Windows [Version 10.0.26100.3194]", the edition happens to be "Windows 11 Pro for Workstations". sfc/scannow, DISM, and chkdsk/f are clean (no reported issues). The installation is basically "fresh" but with quite a few applications installed. I don't think there's anything that would be conflicting at the driver level as it is a fairly "vanilla" installation. I should note that this also seems to be an issue with almost every other tweaking utility available (it's not just gtweak). Auslogics, winaerotweak, and many others all fail to properly disable Defender. There is only ONE application we've noticed that has been able to fully disable Defender (without blocking the security/firewall UI) with 100% success: That is by sordum software "Defender Control" (dControl.exe). I'm not sure if it uses violent methods.

[Greedeks]

I decided to do the same as with Windows updates, changing the name of the executable file, then according to the test results, the defender is completely non-viable.
Code