Scan removable drives
This value controls whether Microsoft Defender Antivirus includes removable media, such as USB flash drives, in full scans.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Scan\DisableRemovableDriveScanning
This value controls whether Microsoft Defender Antivirus includes removable media, such as USB flash drives, in full scans. It is a REG_DWORD value:
0: Removable drives are scanned.1: Removable drives are excluded from full scans.
The setting does not initiate a separate full scan when removable media is connected. Quick scans and custom scans can still examine removable drives independently of this value.
Notes
Security
With a value of 1, a full scan does not comprehensively examine content stored on removable drives. Malware or potentially unwanted applications that remain dormant on such media can therefore escape detection by that scan type.
This setting does not disable real-time protection or every other form of scanning. When real-time protection is active, Microsoft Defender Antivirus continues to inspect files as they are accessed or executed.
Possible side effects
With a value of 0, connected removable drives can increase the duration of a full scan and generate additional CPU and storage I/O activity. The actual impact depends particularly on the amount and complexity of the content and the speed of the drive.
Notes
Microsoft documentation currently gives inconsistent descriptions of the unmanaged default. The Defender policy reference says that an unconfigured setting excludes removable drives from full scans, whereas the full-scan guidance lists removable drives as scanned by default. This inconsistency does not affect the explicit meanings of values 0 and 1.
Microsoft documentation
Microsoft Learn: Defender Policy CSP – AllowFullScanRemovableDriveScanning
Microsoft Learn: Configure scanning options for Microsoft Defender Antivirus