Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Monitor file and program activity on your computer

This machine-wide registry value controls Microsoft Defender Antivirus on-access protection.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

This machine-wide registry value controls Microsoft Defender Antivirus on-access protection. Defender monitors file and program activity and can inspect files when they are opened, read, written, or modified. This continuous protection complements scheduled and on-demand antivirus scans.

The value uses the REG_DWORD data type. Because DisableOnAccessProtection is negatively named, its data has the following meaning:

  • 0 enables monitoring of file and program activity.
  • 1 disables that monitoring.

If the value is absent, the corresponding policy is not configured. Microsoft documents file and program activity monitoring as enabled in that state.

Notes

Security

A value of 1 removes a protection layer that can detect threats when files are accessed. Malicious or potentially unwanted content might therefore not be inspected and blocked at the point when a process accesses it. Other Defender capabilities or a later scan might still detect the content, but they do not fully replace on-access inspection.

This setting does not by itself turn off all real-time protection or Microsoft Defender Antivirus. The real-time monitoring service, behavior monitoring, downloaded-file and attachment scanning, and script scanning are controlled by separate settings.

Notes

The setting is effective only in conjunction with an active Microsoft Defender Antivirus installation and the other required real-time protection components. A separate scan-direction policy determines which inbound or outbound file activity is monitored.

When tamper protection is enabled, changes to this setting might be ignored.

Microsoft documentation

Microsoft Learn: Policy CSP – Defender – AllowOnAccessProtection

Microsoft Learn: Enable and configure Microsoft Defender Antivirus always-on protection

Microsoft: WindowsDefender.admx

See also