Turn on behavior monitoring

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring

This computer policy controls behavior monitoring in Microsoft Defender Antivirus. Behavior monitoring observes process, file, and service activity in real time. It uses known behavioral patterns and anomaly detection to identify and respond to suspicious activity, including threats that do not match known malware signatures.

The underlying value is a REG_DWORD whose name uses inverse logic:

• 0 turns behavior monitoring on.
• 1 turns behavior monitoring off.

Behavior monitoring is enabled when the policy is enabled or not configured. Disabling the policy turns behavior monitoring off. Behavior monitoring is enabled by default.

Notes

Additional effects

Behavior monitoring is required for file-hash allow and block indicators. Network protection also depends on it for IP-address and URL allow and block indicators and for web content filtering. These capabilities are therefore unavailable or limited when behavior monitoring is turned off.

Security

Turning off behavior monitoring reduces Microsoft Defender Antivirus's ability to detect new or evolving threats from their runtime behavior. Suspicious process activity, unusual file modifications, and changes to security-sensitive system areas can remain undetected when no other detection method identifies them.

This setting does not, by itself, disable Microsoft Defender Antivirus or every real-time protection component. It specifically removes the behavior-based detection layer and affects the protection capabilities that depend on that layer.

Possible side effects

Behavior analysis can contribute to CPU usage by the Defender process MsMpEng.exe for certain files, processes, or workloads. Whether it is responsible for elevated CPU utilization depends on the affected system and its activity.

Notes

Behavior monitoring is protected by tamper protection. When tamper protection is active, Windows can block changes made through Group Policy or directly through the registry even if the configured value initially appears to have been accepted. The stored registry value might therefore differ from the effective protection state.

Microsoft documentation

Microsoft Learn: Behavior monitoring in Microsoft Defender Antivirus

Microsoft Learn: Azure Policy guest configuration baseline for Windows Server 2025

Microsoft Learn: Tamper protection overview

See also

• Entry in the reference