cmd: sc config WinDefend start= demand
reg: reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend