Turn on process scanning whenever real-time protection is enabled

This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off.

If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on.

If you disable this setting, a process scan will not be initiated when real-time protection is turned on.

Supported on: At least Windows Server 2012, Windows 8 or Windows RT

Registry HiveHKEY_LOCAL_MACHINE
Registry PathSoftware\Policies\Microsoft\Windows Defender\Real-Time Protection
Value NameDisableScanOnRealtimeEnable
Value TypeREG_DWORD
Enabled Value0
Disabled Value1

windowsdefender.admx

Administrative Templates (Computers)

Administrative Templates (Users)