Turn off real-time protection
This machine-level Group Policy setting is backed by the `DisableRealtimeMonitoring` `REG_DWORD` value.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
This machine-level Group Policy setting is backed by the DisableRealtimeMonitoring REG_DWORD value. When Microsoft Defender Antivirus is active, a value of 1 turns off its real-time monitoring. Files and active operations are no longer continuously examined by this protection function for known or suspected malicious activity.
A value of 0 does not disable real-time monitoring. If the value is absent, this particular policy does not enforce either state. Because the setting is phrased negatively, enabling the policy corresponds to writing 1.
This value does not disable Microsoft Defender Antivirus as a whole. On-demand or scheduled scans and other independently managed Defender features are not directly configured by this value alone.
Notes
Security
Turning off real-time protection removes the continuous inspection that enables Microsoft Defender Antivirus to detect and immediately block malicious files or activity as they appear. Malware might therefore run or make changes before it is detected by a scheduled or on-demand scan or by another security control. Microsoft states that disabling real-time protection drastically reduces endpoint protection.
Notes
Changes to this setting are not applied while tamper protection is enabled. The effective protection state can consequently differ from the value stored in the registry.
Behavior monitoring, on-access protection, script scanning, and downloaded-file scanning have separate settings. DisableRealtimeMonitoring should therefore not be treated as an indicator of every individual Defender component's state.
Microsoft documentation
Microsoft Learn: Defender Policy CSP – AllowRealtimeMonitoring
Microsoft Learn: Configure Microsoft Defender Antivirus always-on protection