# Temporarily disable Elastic Endpoint on a specific host

**URL:** <https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634>\
**Category:** Endpoint Security\
**Tags:** elastic-stack-security\
**Created:** [May 28, 2025, 8:54am UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634 "2025-05-28T08:54:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArgoAdvisory](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\
**Post date:** [May 28, 2025, 8:54am UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634/1 "2025-05-28T08:54:47Z")

</div>

Good morning everyone!  
I think Elastic Endpoint (or Elastic Defend) is a valid antivirus.

I would like to understand one thing.  
How can I temporarily disable the antivirus on a specific host?  
I am the administrator, but even if I try to access CMD as administrator, it does not stop the Elastic Endpoint service.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\
**Post date:** [May 28, 2025, 10:57am UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634/2 "2025-05-28T10:57:28Z")

</div>

Hi ArgoAdvisory,

The easiest way to temporarily disable it would be to move the host to a policy that doesn't include the defend integration or depending on the number of hosts the policy applies to, to remove the defend integration from that policy.

Is that a workable solution for your case? If it isn't, I would be interested in hearing more about your use case and figuring out if there would be alternatives that still maintain a minimal impact on the overall security of the system.

Thanks!

---

<div class="post-metadata">

**Author:** ![ArgoAdvisory](https://avatars.discourse-cdn.com/v4/letter/a/f4b2a3/32.png) [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\
**Post date:** [May 28, 2025, 2:50pm UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634/3 "2025-05-28T14:50:18Z")

</div>

Hi NickFritts,

Thanks for the quick reply!

Yes, your solution works for me. Thanks!

I just need to disable my Elastic Defend every now and then to do some work, so it's just a single host.  
Is there a "temporarily disable" button added in the roadmap?

Thank you!

---

<div class="post-metadata">

**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\
**Post date:** [May 28, 2025, 3:09pm UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634/4 "2025-05-28T15:09:26Z")

</div>

> [@ArgoAdvisory](#):
>
> Is there a "temporarily disable" button added in the roadmap?

Defend is designed to be administered exclusively through Kibana. It's not intended to be administered by local admins because malware often obtains local admin rights.

From the Fleet screen, it's only a few clicks to reassign an Agent's policy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2025, 3:10pm UTC](https://discuss.elastic.co/t/temporarily-disable-elastic-endpoint-on-a-specific-host/378634/5 "2025-06-25T15:10:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.