Turn off real-time protection

This policy turns off real-time protection in Microsoft Defender Antivirus. Real-time protection consists of always-on scanning with file and process behavior monitoring and heuristics. When real-time protection is on, Microsoft Defender Antivirus detects malware and potentially unwanted software that attempts to install itself or run on your device, and prompts you to take action on malware detections. If you enable this policy setting, real-time protection is turned off. If you either disable or do not configure this policy setting, real-time protection is turned on.

Policy Details

Policy Name

DisableRealtimeMonitoring

Registry Key

Software\Policies\Microsoft\Windows Defender\Real-Time Protection

Value Name

DisableRealtimeMonitoring

Supported On

At least Windows Vista

OMA-URI (CSP)

ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring

OS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202

CSP Version:10.0

Conflict Resolution:LastWrite

Allowed Editions:

EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval

Policy State Values

Enabled: 1

Disabled: 0

Available Languages

en-us