I had an interesting evening the other day trying to completely prevent Windows Defender from running. In the end I had to change the name of the defender executable as defined in the registry.