Scan all downloaded files and attachments
This value controls whether Microsoft Defender Antivirus scans downloaded files and attachments through IOAV protection.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
This value controls whether Microsoft Defender Antivirus scans downloaded files and attachments through IOAV protection. It is a REG_DWORD value with negative logic:
0: Scanning of downloaded files and attachments is enabled.1: Scanning of downloaded files and attachments is disabled.
If the value is absent, this registry setting does not impose a different state. Microsoft Defender Antivirus scans downloaded files and attachments by default.
Notes
Security
A value of 1 removes the scanning layer intended specifically for downloads and attachments. Malicious or potentially unwanted content can therefore reach the device without being inspected at that boundary.
This value does not automatically disable other Microsoft Defender Antivirus protections, such as general real-time protection. Those components might still detect a file when it is accessed or executed, provided that they remain enabled. Disabling IOAV scanning nevertheless reduces protection at the point where downloads and attachments are introduced.
A value of 0 enables this additional inspection but does not guarantee detection of every malicious file. Detection also depends on factors such as the state of the antimalware engine and the available security intelligence.
Notes
The setting applies at the device level.
When tamper protection is enabled, changes to this protected Defender setting might not take effect. Microsoft specifically notes that tamper protection can block changes made through management tools or directly through the registry.
The corresponding AllowIOAVProtection Policy CSP node uses positive and therefore opposite value semantics: for that CSP setting, 1 means that the feature is allowed. Its values must not be treated as the registry data for DisableIOAVProtection.
Microsoft documentation
Microsoft Learn: Defender Policy CSP – AllowIOAVProtection
Microsoft Learn: Set-MpPreference – DisableIOAVProtection