If you use windows server you can just type `Uninstall-WindowsFeature WindowsDefender` (or similar, that might be the wrong feature name). If you use client windows there are two options, first you can disable "anti-tamper" and then disable the defender services with the TrustedInstaller token, this takes a few tries and often does not work on modern versions of windows or while defender is running (you can do it by editing the registry from safe-mode or linux).

Another option is to enable "Smart App Control" this will permanently disable defender but you will only be able to run signed executables, and to turn it on you must have never run any unsigned executables in the past (or reformat your hard drive).

There's an app called DefenderControl that will disable it, as well, using various methods.

You can also install some other anti-virus software, but you can't make your own -- they need to be signed with a special key.

A fun bit of trivia: defender doesn't turn itself on until after the "out of box experience" is finished, under the rationale that users can't install any malware until they can use the computer. Thus you can run defender disabling scripts/programs from a customized installer without them getting nuked by defender.