Configure real-time protection and Security Intelligence Updates during OOBE
This registry value controls whether Microsoft Defender Antivirus enables real-time protection and Security Intelligence Updates during the Windows Out-of-Box Experience (OOBE).
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\OobeEnableRtpAndSigUpdate
This registry value controls whether Microsoft Defender Antivirus enables real-time protection and Security Intelligence Updates during the Windows Out-of-Box Experience (OOBE).
Setting the REG_DWORD value to 1 enables both capabilities during OOBE. Real-time protection can then inspect file and program activity for threats as it occurs. Security Intelligence Updates provide the antivirus engine with newer detection information when a configured update source is reachable.
Notes
Security
This setting reduces the period in which a newly provisioned device might operate without Microsoft Defender Antivirus real-time protection or with only the security intelligence included in its Windows image. It therefore improves protection against malware introduced or executed during initial setup.
The value does not enable unrelated protection features or guarantee detection of every threat. Its effectiveness also depends on Microsoft Defender Antivirus being operational and on the availability of the required update sources.
Notes
This is a device-wide setting that applies specifically to OOBE. It does not determine how real-time protection or Security Intelligence Updates behave after initial setup is complete.
Microsoft documents the corresponding Defender setting for Windows 10, version 1607 and later supported Windows versions. A value of 0, or an unconfigured setting, does not specifically enable these capabilities during OOBE.
Microsoft documentation
Microsoft Learn: Defender CSP – OobeEnableRtpAndSigUpdate
Microsoft Learn: Windows security baseline for Windows Server 2025 – registry mapping