I believe that Windows Defender included in Windows 10 implements some forms of protection other than signature-based threat detection. Two Group Policy settings indicates this: "Turn on behavior monitoring" and "Monitor file and program activity on your computer".

Since I really dislike signature based-detection (and employ a really strict policy for threat mitigation instead), it's of my best interest to disable real-time file scanning in my Windows 10 system, but without turning off real-time protection entirely. Can it be done?

There's a policy setting called "Turn off real-time protection", but judging by it's name, I'm afraid it disables the other components. There's also "Scan all downloaded files and attachments", which I tried setting to Disabled, but doesn't seem to work (browsing through files and plugging external drives still triggers file scanning).


  • Real-time protection is behavior based; it's either enabled or not; defender Defender doesn't employ anything else – Ramhound Jun 18 '16 at 16:36
  • @Ramhound Not really. Real-time protection is, without a doubt, signature-based, and -supposedly- some other mechanisms. – Marc.2377 Jun 18 '16 at 20:12

Found the answer myself (more details here). Basically, it's as simple as setting the Group Policy called Monitor file and program activity on your computer to Disabled.

For users of Windows editions without gpedit.msc, a DWORD entry called DisableOnAccessProtection must be created under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Real-Time Protection and set to 1.

The name of this registry entry tells you exactly what "Monitor file and program activity" actually do: It scans files "On Access" (such as when Windows Explorer lists the contents of a directory). Nothing more.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.