Malicious Software Removal Tool (MRT): How to disable the monthly download and run via Windows Update

The Microsoft Windows Malicious Software Removal Tool (MRT) is downloaded and run with the monthly Windows Update cycle on many Windows versions (e.g. Windows 7, 8.1, 10, Windows Server 2012 R2 and others). It always uses the same KB/Patch number:

KB890830

You can disable this in Windows Update by hiding the update, but it will be re-offered next month. To permanantly disable the offering via Windows Update, change this registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT]
"DontOfferThroughWUAU"=dword:00000001

It's possible that the MRT folder does not exist. Just create it and then create the dword(32) entry.

Then start "Check for updates" in Windows Update. After it finishes, MRT should not be there any more.

Side note: It is still possible to run MRT manually:

Press Windows-R

Type "MRT.exe" in the Run box.

14 thoughts on “Malicious Software Removal Tool (MRT): How to disable the monthly download and run via Windows Update”

  1. On this W10 Pro-64bit the MRT key in HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftMRT does not exist. It does have a key with 2 subkeys for Windows Defender.

    I had disabled Windows Defender long ago since it sometimes seemed to remove safe third party programs without even asking, but I want to stop the updates.

    I just tried using the Group Policy Editor to do so as instructed here:
    https://technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services

      1. Sorry: I must have skipped past "It's possible that the MRT folder does not exist..." But the gpedit.msc solution worked for me. I had previously used it to delay updates in hopes of avoiding new problems resulting from new updates until they were fixed, but the MRT files were awaiting download and installation, and after I followed the instructions for gpedit.msc, then I choose to get the updates and the MRT definitions were not downloaded.

        However, I do not think gpedit.msc is available with lower versions if W/10, and thanks for your fix in any case.

  2. Now it's working for W10-64bit as well. Apparently, you have to stop and restart WUAUserv and reboot multiple times if MRT is already queued for update.

  3. The registry key "DontOfferThroughWUAU" has absolutely NO effect. The MSRT is still offered for download each month.

      1. Windoze 10 version 1607 Build 14393.351.
        It now appears to work for W7 and W10/32-bit, but not for W10-64bit.

  4. Hi, TYVM; but, no Windows 10 information has been included and, perhaps, it would've been nice to -also- handle this using the Group Policy (Editor), gpedit.msc

    1. Hi Nostromov, thanks for your comments.

      I have checked for Windows 10 and found that the registry key also works on Win 10. I have updated the blog post accordingly.

      I did not find a group policy in gpedit.msc that matches this setting.

      1. Hi
        The key you refer to ("DontOfferThroughWUAU"=dword:00000001), does not exist at least on my machine.
        It's, (DontReportInfectionInformation=dword:00000001). My question is, can I add the above and will it work? Running Windows 10 version 10.0.14393

Leave a Reply

Your email address will not be published. Required fields are marked *