enable SeDebugPrivilege;
start the TrustedInstaller service and TrustedInstaller process;
impersonate TrustedInstaller;
open the WinDefend service and stop it;