Turn on process scanning whenever real-time protection is enabled
This machine policy value controls whether Microsoft Defender Antivirus initiates a process scan when real-time protection is turned on.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
This machine policy value controls whether Microsoft Defender Antivirus initiates a process scan when real-time protection is turned on. The scan can detect malware that might have started while real-time protection was off.
The value uses the REG_DWORD data type:
0: A process scan is initiated when real-time protection is turned on. This corresponds to the policy being enabled.1: No process scan is initiated when real-time protection is turned on. This corresponds to the policy being disabled.
When the policy is not configured and the value is therefore absent, Microsoft Defender Antivirus also initiates the process scan.
Notes
Security
A value of 1 removes a specific opportunity to detect malware that started during an interruption in real-time protection and remains active when protection is restored. It does not itself turn off real-time protection or disable every other Microsoft Defender Antivirus scanning capability.
Notes
The inverted value semantics reflect the Disable prefix in the value name: 0 permits the process scan, whereas 1 prevents it.
According to Microsoft, changes to this setting are not applied while tamper protection is enabled.
Microsoft documentation
Microsoft Learn: Policy CSP – ADMX_MicrosoftDefenderAntivirus
Microsoft: WindowsDefender.admx