RW>enable SeDebugPrivilege;
RW>start the TrustedInstaller service and TrustedInstaller process;
RW>impersonate TrustedInstaller;
RW>open the WinDefend service and stop it;