Turn off real-time protection

Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista

This policy turns off real-time protection in Microsoft Defender Antivirus. Real-time protection consists of always-on scanning with file and process behavior monitoring and heuristics. When real-time protection is on, Microsoft Defender Antivirus detects malware and potentially unwanted software that attempts to install itself or run on your device, and prompts you to take action on malware detections. If you enable this policy setting, real-time protection is turned off. If you either disable or do not configure this policy setting, real-time protection is turned on.

This policy has no additional user input fields.

• Computer
  Configure local setting override for monitoring file and program activity on your computer

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure local setting override for monitoring for incoming and outgoing file activity

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure local setting override for scanning all downloaded files and attachments

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure local setting override for turn on behavior monitoring

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure local setting override to turn on real-time protection

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure monitoring for incoming and outgoing file and program activity

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure performance mode status

  Windows 11 22H1