Turn off routine remediation
This machine-wide registry value controls whether Microsoft Defender Antivirus automatically takes remediation action on detected threats.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\DisableRoutinelyTakingAction
This machine-wide registry value controls whether Microsoft Defender Antivirus automatically takes remediation action on detected threats.
When the REG_DWORD value is set to 1, automatic remediation is disabled. Microsoft Defender Antivirus instead prompts the user to select one of the actions available for the detected threat. The applicable actions are determined by the combination of policy-defined, user-defined, and security-intelligence-defined actions.
When the value is 0 or is absent, Microsoft Defender Antivirus automatically performs the applicable action. Microsoft documents a nonconfigurable delay of approximately five seconds after detection.
Notes
Security
Disabling automatic remediation can leave detected threats unresolved until a user selects an action. If the user does not respond or selects an action that does not remediate the threat, the detection remains unresolved and the associated exposure persists for longer.
This value does not itself disable threat detection, scanning, or real-time protection. It controls only whether the applicable remediation action is performed automatically or waits for user selection.
Notes
Changes to this setting are not applied when Microsoft Defender Antivirus tamper protection prevents the setting from taking effect.
On Windows versions earlier than Windows 10, version 2004, the corresponding policy path might use “Windows Defender Antivirus” instead of “Microsoft Defender Antivirus.” Both names refer to the same policy location.
Microsoft documentation
Microsoft Learn: ADMX_MicrosoftDefenderAntivirus – DisableRoutinelyTakingAction
Microsoft Learn: Configure remediation for Microsoft Defender Antivirus detections