Policy
Configure monitoring for incoming and outgoing file and program activity
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016
This policy setting allows you to configure monitoring for incoming and outgoing files, without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. Note that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only Any other value, or if the value does not exist, resolves to the default (0). If you enable this setting, the specified type of monitoring will be enabled. If you disable or do not configure this setting, monitoring for incoming and outgoing files will be enabled.
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Element | Type | Registry mapping | Constraints & behavior |
|---|---|---|---|
Configure monitoring for incoming and outgoing file and program activity ID RealtimeProtection_RealtimeScanDirection | enum | HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection Type REG_DWORD | Options: bi-directional (full on-access) (0), scan only incoming (disable on-open) (1), scan only outgoing (disable on-close) (2) |
Other policies in this category
Explore related policies at the same level.
- ComputerConfigure local setting override for monitoring file and program activity on your computerAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerConfigure local setting override for monitoring for incoming and outgoing file activityAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerConfigure local setting override for scanning all downloaded files and attachmentsAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerConfigure local setting override for turn on behavior monitoringAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerConfigure local setting override to turn on real-time protectionAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerConfigure performance mode statusWindows 11 22H1
- ComputerConfigure real-time protection and Security Intelligence Updates during OOBEAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerDefine the maximum size of downloaded files and attachments to be scannedAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerMonitor file and program activity on your computerAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerScan all downloaded files and attachmentsAt least Windows Server 2012, Windows 8 or Windows RT
- ComputerTurn off real-time protectionAt least Windows Vista
- ComputerTurn on behavior monitoringAt least Windows Server 2012, Windows 8 or Windows RT