Turn on script scanning

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning

This value controls script scanning in Microsoft Defender Antivirus. It is a REG_DWORD value whose name uses inverse logic:

• 0 enables script scanning.
• 1 disables script scanning.

When the associated policy isn't configured and the value is therefore not enforced, script scanning is enabled by default.

With script scanning enabled, Microsoft Defender Antivirus can inspect script content before it runs on the system. Content identified as malicious can consequently be blocked.

Notes

Additional effects

Script scanning is required for the script-related integration of Microsoft Defender Antivirus with the Antimalware Scan Interface (AMSI). AMSI allows supported scripting and runtime environments to submit content to the antimalware engine for inspection. This provides additional visibility into dynamically generated, obfuscated, and fileless malicious code.

Security

A value of 1 removes this layer of protection. Script-based attacks can consequently avoid an important Microsoft Defender Antivirus inspection path, particularly when code is generated at runtime or executed through an AMSI-capable scripting environment.

Disabling script scanning does not disable Microsoft Defender Antivirus as a whole. Other protection features remain available according to their own settings, but they do not necessarily replace content inspection of scripts.

Notes

Changes to this setting might not be applied while Microsoft Defender tamper protection is enabled.

The Group Policy setting and the registry value use opposite wording: the policy turns script scanning on, whereas the DisableScriptScanning value represents its disable state.

Microsoft documentation

Microsoft Learn: Defender Policy CSP – AllowScriptScanning

Microsoft Learn: Configure scanning options for Microsoft Defender Antivirus

See also

• Entry in the reference