Disable or Uninstall Malicious Software Removal Tool on Windows Server KB890830 Automatic Maintenance
Turns out the Automatic Maintenance tasks are managed by C:\Windows\System32\MSchedExe.exe
and the Scheduled Tasks under the \Microsoft\Windows\TaskScheduler
folder. It then will run other tasks that are defined but don't have a specified trigger, one being the MRT_HB
task under \Microsoft\Windows\RemovalTools\
.
Here you can see it calling MRT.exe to run the scan, and the last run time matches the information from the Action Center:
If you disable this Scheduled Task it should prevent the Malicious Software Removal Tool from running. You also can delete the task and the MRT.exe program using the following in an elevated PowerShell prompt:
Unregister-ScheduledTask -TaskName 'MRT_HB' -TaskPath '\Microsoft\Windows\RemovalTools\' -Confirm:$false
Remove-Item 'C:\Windows\System32\MRT.exe' -Force
Note, however, that if you haven't disabled the KB890830 update in WSUS or via the registry it likely will be reinstalled, as MRT gets updated every patch Tuesday.