powershellwindowswindows-server-2016
Set-MpPreference -DisableRealtimeMonitoring disables the first one, what are the specific switches to disable the others you see when you open the UI? I have not found a clear example of this in the docs and I don't feel like running EVERY disable switch because MS docs are bad.
I've had success with Sysinternals Process Explorer. With this, you can search to find what process(es) have a file open, and you can use it to close the handle(s) if you want. Of course, it is safer to close the whole process. Exercise caution and judgement.
To find a specific file, use the menu option Find->Find Handle or DLL... Type in part of the path to the file. The list of processes will appear below.
If you prefer command line, Sysinternals suite includes command line tool Handle, that lists open handles.
Examples
c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "e:\" (finds all files opened from drive e:\"c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "file-or-path-in-question"
Best Answer
After going for hours through the docs: https://docs.microsoft.com/en-us/powershell/module/defender/index?view=win10-ps
Just decided to uninstall it. This works on WS 2016 with PS 5.1.
The below didn't work for me (from a blog dated 2011-2012), but give it a try before you uninstall:
Later edit: Found a way for Windows 10, tested on 20H2 only. Please add a comment if it works for previous builds.