Policy CSP - ADMX_MicrosoftDefenderAntivirus

Tip

This CSP contains ADMX-backed policies which require a special SyncML format to enable or disable. You must specify the data type in the SyncML as <Format>chr</Format>. For details, see Understanding ADMX-backed policies.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

AllowFastServiceStartup

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup

This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance.

• If you enable or don't configure this setting, the antimalware service will load as a normal priority task.

• If you disable this setting, the antimalware service will load as a low priority task.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	AllowFastServiceStartup
Friendly Name	Allow antimalware service to startup with normal priority
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	AllowFastServiceStartup
ADMX File Name	WindowsDefender.admx

DisableAntiSpywareDefender

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender

This policy setting turns off Microsoft Defender Antivirus.

• If you enable this policy setting, Microsoft Defender Antivirus doesn't run, and won't scan computers for malware or other potentially unwanted software.

• If you disable this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product.

• If you don't configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software.

Enabling or disabling this policy may lead to unexpected or unsupported behavior. It's recommended that you leave this policy setting unconfigured.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableAntiSpywareDefender
Friendly Name	Turn off Microsoft Defender Antivirus
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	DisableAntiSpyware
ADMX File Name	WindowsDefender.admx

DisableAutoExclusions

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions

Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.

Disabled (Default):

Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance.

Enabled:

Microsoft Defender won't exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios.

Not configured:

Same as Disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableAutoExclusions
Friendly Name	Turn off Auto Exclusions
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Exclusions
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Exclusions
Registry Value Name	DisableAutoExclusions
ADMX File Name	WindowsDefender.admx

DisableBlockAtFirstSeen

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check won't occur, which will lower the protection state of the device.

Enabled - The Block at First Sight setting is turned on.

Disabled - The Block at First Sight setting is turned off.

This feature requires these Group Policy settings to be set as follows:

MAPS -> The "Join Microsoft MAPS" must be enabled or the "Block at First Sight" feature won't function.

MAPS -> The "Send file samples when further analysis is required" should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature won't function.

Real-time Protection -> The "Scan all downloaded files and attachments" policy must be enabled or the "Block at First Sight" feature won't function.

Real-time Protection -> Don't enable the "Turn off real-time protection" policy or the "Block at First Sight" feature won't function.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableBlockAtFirstSeen
Friendly Name	Configure the 'Block at First Sight' feature
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > MAPS
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Spynet
Registry Value Name	DisableBlockAtFirstSeen
ADMX File Name	WindowsDefender.admx

DisableLocalAdminMerge

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge

This policy setting controls whether or not complex list settings configured by a local administrator are merged with Group Policy settings. This setting applies to lists such as threats and Exclusions.

• If you disable or don't configure this setting, unique items defined in Group Policy and in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, Group policy Settings will override preference settings.

• If you enable this setting, only items defined by Group Policy will be used in the resulting effective policy. Group Policy settings will override preference settings configured by the local administrator.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableLocalAdminMerge
Friendly Name	Configure local administrator merge behavior for lists
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	DisableLocalAdminMerge
ADMX File Name	WindowsDefender.admx

DisableRealtimeMonitoring

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring

This policy turns off real-time protection in Microsoft Defender Antivirus.

Real-time protection consists of always-on scanning with file and process behavior monitoring and heuristics. When real-time protection is on, Microsoft Defender Antivirus detects malware and potentially unwanted software that attempts to install itself or run on your device, and prompts you to take action on malware detections.

• If you enable this policy setting, real-time protection is turned off.

• If you either disable or don't configure this policy setting, real-time protection is turned on.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableRealtimeMonitoring
Friendly Name	Turn off real-time protection
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableRealtimeMonitoring
ADMX File Name	WindowsDefender.admx

DisableRoutinelyTakingAction

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction

This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action.

• If you enable this policy setting, Microsoft Defender Antivirus doesn't automatically take action on the detected threats, but prompts users to choose from the actions available for each threat.

• If you disable or don't configure this policy setting, Microsoft Defender Antivirus automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	DisableRoutinelyTakingAction
Friendly Name	Turn off routine remediation
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	DisableRoutinelyTakingAction
ADMX File Name	WindowsDefender.admx

Exclusions_Extensions

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions

This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value isn't used and it's recommended that this be set to 0.

Note

To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when certain conditions are met.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Exclusions_Extensions
Friendly Name	Extension Exclusions
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Exclusions
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Exclusions
Registry Value Name	Exclusions_Extensions
ADMX File Name	WindowsDefender.admx

Exclusions_Paths

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths

This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value isn't used and it's recommended that this be set to 0.

Note

To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when certain conditions are met.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Exclusions_Paths
Friendly Name	Path Exclusions
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Exclusions
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Exclusions
Registry Value Name	Exclusions_Paths
ADMX File Name	WindowsDefender.admx

Exclusions_Processes

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes

This policy setting allows you to disable real-time scanning for any file opened by any of the specified processes. This policy doesn't apply to scheduled scans. The process itself won't be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value isn't used and it's recommended that this be set to 0.

Note

To prevent unauthorized changes to exclusions, apply tamper protection. Tamper protection for exclusions only works when certain conditions are met.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Exclusions_Processes
Friendly Name	Process Exclusions
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Exclusions
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Exclusions
Registry Value Name	Exclusions_Processes
ADMX File Name	WindowsDefender.admx

ExploitGuard_ASR_ASROnlyExclusions

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions

Exclude files and paths from Attack Surface Reduction (ASR) rules.

Enabled:

Specify the folders or files and resources that should be excluded from ASR rules in the Options section.

Enter each rule on a new line as a name-value pair:

• Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder
• Value column: Enter "0" for each item.

Disabled:

No exclusions will be applied to the ASR rules.

Not configured:

Same as Disabled.

You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ExploitGuard_ASR_ASROnlyExclusions
Friendly Name	Exclude files and paths from Attack Surface Reduction Rules
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR
Registry Value Name	ExploitGuard_ASR_ASROnlyExclusions
ADMX File Name	WindowsDefender.admx

ExploitGuard_ASR_Rules

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules

Set the state for each Attack Surface Reduction (ASR) rule.

After enabling this setting, you can set each rule to the following in the Options section:

• Block: the rule will be applied
• Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule won't actually be applied)
• Off: the rule won't be applied
• Not Configured: the rule is enabled with default values
• Warn: the rule will be applied and the end-user will have the option to bypass the block.

Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured.

Enabled:

Specify the state for each ASR rule under the Options section for this setting.

Enter each rule on a new line as a name-value pair:

• Name column: Enter a valid ASR rule ID
• Value column: Enter the status ID that relates to state you want to specify for the associated rule.

The following status IDs are permitted under the value column:

• 1 (Block)
• 0 (Off)
• 2 (Audit)
• 5 (Not Configured)
• 6 (Warn)

Example:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2

Disabled:

No ASR rules will be configured.

Not configured:

Same as Disabled.

You can exclude folders or files in the "Exclude files and paths from Attack Surface Reduction Rules" GP setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ExploitGuard_ASR_Rules
Friendly Name	Configure Attack Surface Reduction rules
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR
Registry Value Name	ExploitGuard_ASR_Rules
ADMX File Name	WindowsDefender.admx

ExploitGuard_ControlledFolderAccess_AllowedApplications

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications

Add additional applications that should be considered "trusted" by controlled folder access.

These applications are allowed to modify or delete files in controlled folder access folders.

Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications.

Enabled:

Specify additional allowed applications in the Options section.

Disabled:

No additional applications will be added to the trusted list.

Not configured:

Same as Disabled.

You can enable controlled folder access in the Configure controlled folder access GP setting.

Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ExploitGuard_ControlledFolderAccess_AllowedApplications
Friendly Name	Configure allowed applications
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access
Registry Value Name	ExploitGuard_ControlledFolderAccess_AllowedApplications
ADMX File Name	WindowsDefender.admx

ExploitGuard_ControlledFolderAccess_ProtectedFolders

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders

Specify additional folders that should be guarded by the Controlled folder access feature.

Files in these folders can't be modified or deleted by untrusted applications.

Default system folders are automatically protected. You can configure this setting to add additional folders.

The list of default system folders that are protected is shown in Windows Security.

Enabled:

Specify additional folders that should be protected in the Options section.

Disabled:

No additional folders will be protected.

Not configured:

Same as Disabled.

You can enable controlled folder access in the Configure controlled folder access GP setting.

Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ExploitGuard_ControlledFolderAccess_ProtectedFolders
Friendly Name	Configure protected folders
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access
Registry Value Name	ExploitGuard_ControlledFolderAccess_ProtectedFolders
ADMX File Name	WindowsDefender.admx

MpEngine_EnableFileHashComputation

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation

Enable or disable file hash computation feature.

Enabled:

When this feature is enabled Microsoft Defender will compute hash value for files it scans.

Disabled:

File hash value isn't computed.

Not configured:

Same as Disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	MpEngine_EnableFileHashComputation
Friendly Name	Enable file hash computation feature
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > MpEngine
Registry Key Name	Software\Policies\Microsoft\Windows Defender\MpEngine
Registry Value Name	EnableFileHashComputation
ADMX File Name	WindowsDefender.admx

Nis_Consumers_IPS_DisableSignatureRetirement

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement

This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system isn't vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocal are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that's up-to-date with all the latest security updates, network protection will have no impact on network performance.

• If you enable or don't configure this setting, definition retirement will be enabled.

• If you disable this setting, definition retirement will be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Nis_Consumers_IPS_DisableSignatureRetirement
Friendly Name	Turn on definition retirement
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Network Inspection System
Registry Key Name	Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS
Registry Value Name	DisableSignatureRetirement
ADMX File Name	WindowsDefender.admx

Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid

This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: "{b54b6ac9-a737-498e-9120-6616ad3bf590}". The value isn't used and it's recommended that this be set to 0.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid
Friendly Name	Specify additional definition sets for network traffic inspection
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Network Inspection System
Registry Key Name	Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation
Registry Value Name	Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid
ADMX File Name	WindowsDefender.admx

Nis_DisableProtocolRecognition

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition

This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities.

• If you enable or don't configure this setting, protocol recognition will be enabled.

• If you disable this setting, protocol recognition will be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Nis_DisableProtocolRecognition
Friendly Name	Turn on protocol recognition
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Network Inspection System
Registry Key Name	Software\Policies\Microsoft\Windows Defender\NIS
Registry Value Name	DisableProtocolRecognition
ADMX File Name	WindowsDefender.admx

ProxyBypass

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ProxyBypass

This policy, if defined, will prevent antimalware from using the configured proxy server when communicating with the specified IP addresses. The address value should be entered as a valid URL.

• If you enable this setting, the proxy server will be bypassed for the specified addresses.

• If you disable or don't configure this setting, the proxy server won't be bypassed for the specified addresses.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ProxyBypass
Friendly Name	Define addresses to bypass proxy server
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
ADMX File Name	WindowsDefender.admx

ProxyPacUrl

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl

This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for security intelligence updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order):

1. Proxy server (if specified)

2. Proxy .pac URL (if specified)

3. None

4. Internet Explorer proxy settings.

5. Autodetect.

• If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above.

• If you disable or don't configure this setting, the proxy will skip over this fallback step according to the order specified above.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ProxyPacUrl
Friendly Name	Define proxy auto-config (.pac) for connecting to the network
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
ADMX File Name	WindowsDefender.admx

ProxyServer

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ProxyServer

This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for security intelligence updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order):

1. Proxy server (if specified)

2. Proxy .pac URL (if specified)

3. None

4. Internet Explorer proxy settings.

5. Autodetect.

• If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either https:// or https://.

• If you disable or don't configure this setting, the proxy will skip over this fallback step according to the order specified above.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ProxyServer
Friendly Name	Define proxy server for connecting to the network
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
ADMX File Name	WindowsDefender.admx

Quarantine_LocalSettingOverridePurgeItemsAfterDelay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay

This policy setting configures a local override for the configuration of the number of days items should be kept in the Quarantine folder before being removed. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Quarantine_LocalSettingOverridePurgeItemsAfterDelay
Friendly Name	Configure local setting override for the removal of items from Quarantine folder
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Quarantine
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Quarantine
Registry Value Name	LocalSettingOverridePurgeItemsAfterDelay
ADMX File Name	WindowsDefender.admx

Quarantine_PurgeItemsAfterDelay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay

This policy setting defines the number of days items should be kept in the Quarantine folder before being removed.

• If you enable this setting, items will be removed from the Quarantine folder after the number of days specified.

• If you disable or don't configure this setting, items will be kept in the quarantine folder indefinitely and won't be automatically removed.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Quarantine_PurgeItemsAfterDelay
Friendly Name	Configure removal of items from Quarantine folder
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Quarantine
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Quarantine
Registry Value Name	PurgeItemsAfterDelay
ADMX File Name	WindowsDefender.admx

RandomizeScheduleTaskTimes

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes

This policy setting allows you to configure the randomization of the scheduled scan start time and the scheduled definition update start time.

• If you enable or don't configure this policy setting, and didn't set a randomization window in the Configure scheduled task time randomization window setting , then randomization will be added between 0-4 hours.

• If you enable or don't configure this policy setting, and set a randomization window in the Configure scheduled task time randomization window setting, the configured randomization window will be used.

• If you disable this policy setting, but configured the scheduled task time randomization window, randomization won't be done.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RandomizeScheduleTaskTimes
Friendly Name	Randomize scheduled task times
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	RandomizeScheduleTaskTimes
ADMX File Name	WindowsDefender.admx

RealtimeProtection_DisableBehaviorMonitoring

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring

This policy setting allows you to configure behavior monitoring.

• If you enable or don't configure this setting, behavior monitoring will be enabled.

• If you disable this setting, behavior monitoring will be disabled.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_DisableBehaviorMonitoring
Friendly Name	Turn on behavior monitoring
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableBehaviorMonitoring
ADMX File Name	WindowsDefender.admx

RealtimeProtection_DisableIOAVProtection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection

This policy setting allows you to configure scanning for all downloaded files and attachments.

• If you enable or don't configure this setting, scanning for all downloaded files and attachments will be enabled.

• If you disable this setting, scanning for all downloaded files and attachments will be disabled.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_DisableIOAVProtection
Friendly Name	Scan all downloaded files and attachments
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableIOAVProtection
ADMX File Name	WindowsDefender.admx

RealtimeProtection_DisableOnAccessProtection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection

This policy setting allows you to configure monitoring for file and program activity.

• If you enable or don't configure this setting, monitoring for file and program activity will be enabled.

• If you disable this setting, monitoring for file and program activity will be disabled.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_DisableOnAccessProtection
Friendly Name	Monitor file and program activity on your computer
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableOnAccessProtection
ADMX File Name	WindowsDefender.admx

RealtimeProtection_DisableRawWriteNotification

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification

This policy setting controls whether raw volume write notifications are sent to behavior monitoring.

• If you enable or don't configure this setting, raw write notifications will be enabled.

• If you disable this setting, raw write notifications be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_DisableRawWriteNotification
Friendly Name	Turn on raw volume write notifications
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableRawWriteNotification
ADMX File Name	WindowsDefender.admx

RealtimeProtection_DisableScanOnRealtimeEnable

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable

This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off.

• If you enable or don't configure this setting, a process scan will be initiated when real-time protection is turned on.

• If you disable this setting, a process scan won't be initiated when real-time protection is turned on.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_DisableScanOnRealtimeEnable
Friendly Name	Turn on process scanning whenever real-time protection is enabled
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	DisableScanOnRealtimeEnable
ADMX File Name	WindowsDefender.admx

RealtimeProtection_IOAVMaxSize

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize

This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that will be scanned.

• If you enable this setting, downloaded files and attachments smaller than the size specified will be scanned.

• If you disable or don't configure this setting, a default size will be applied.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_IOAVMaxSize
Friendly Name	Define the maximum size of downloaded files and attachments to be scanned
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	IOAVMaxSize
ADMX File Name	WindowsDefender.admx

RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring

This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring
Friendly Name	Configure local setting override for turn on behavior monitoring
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	LocalSettingOverrideDisableBehaviorMonitoring
ADMX File Name	WindowsDefender.admx

RealtimeProtection_LocalSettingOverrideDisableIOAVProtection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection

This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_LocalSettingOverrideDisableIOAVProtection
Friendly Name	Configure local setting override for scanning all downloaded files and attachments
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	LocalSettingOverrideDisableIOAVProtection
ADMX File Name	WindowsDefender.admx

RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection

This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection
Friendly Name	Configure local setting override for monitoring file and program activity on your computer
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	LocalSettingOverrideDisableOnAccessProtection
ADMX File Name	WindowsDefender.admx

RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring

This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring
Friendly Name	Configure local setting override to turn on real-time protection
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	LocalSettingOverrideDisableRealtimeMonitoring
ADMX File Name	WindowsDefender.admx

RealtimeProtection_LocalSettingOverrideRealtimeScanDirection

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection

This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	RealtimeProtection_LocalSettingOverrideRealtimeScanDirection
Friendly Name	Configure local setting override for monitoring for incoming and outgoing file activity
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Real-time Protection
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Real-Time Protection
Registry Value Name	LocalSettingOverrideRealtimeScanDirection
ADMX File Name	WindowsDefender.admx

Remediation_LocalSettingOverrideScan_ScheduleTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime

This policy setting configures a local override for the configuration of the time to run a scheduled full scan to complete remediation. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Remediation_LocalSettingOverrideScan_ScheduleTime
Friendly Name	Configure local setting override for the time of day to run a scheduled full scan to complete remediation
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Remediation
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Remediation
Registry Value Name	LocalSettingOverrideScan_ScheduleTime
ADMX File Name	WindowsDefender.admx

Remediation_Scan_ScheduleDay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay

This policy setting allows you to specify the day of the week on which to perform a scheduled full scan in order to complete remediation. The scan can also be configured to run every day or to never run at all.

This setting can be configured with the following ordinal number values:

(0x0) Every Day (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never (default)

• If you enable this setting, a scheduled full scan to complete remediation will run at the frequency specified.

• If you disable or don't configure this setting, a scheduled full scan to complete remediation will run at a default frequency.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Remediation_Scan_ScheduleDay
Friendly Name	Specify the day of the week to run a scheduled full scan to complete remediation
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Remediation
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Remediation
Registry Value Name	Scan_ScheduleDay
ADMX File Name	WindowsDefender.admx

Remediation_Scan_ScheduleTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime

This policy setting allows you to specify the time of day at which to perform a scheduled full scan in order to complete remediation. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. The schedule is based on local time on the computer where the scan is executing.

• If you enable this setting, a scheduled full scan to complete remediation will run at the time of day specified.

• If you disable or don't configure this setting, a scheduled full scan to complete remediation will run at a default time.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Remediation_Scan_ScheduleTime
Friendly Name	Specify the time of day to run a scheduled full scan to complete remediation
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Remediation
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Remediation
Registry Value Name	Scan_ScheduleTime
ADMX File Name	WindowsDefender.admx

Reporting_AdditionalActionTimeout

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout

This policy setting configures the time in minutes before a detection in the "additional action" state moves to the "cleared" state.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_AdditionalActionTimeout
Friendly Name	Configure time out for detections requiring additional action
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	AdditionalActionTimeout
ADMX File Name	WindowsDefender.admx

Reporting_CriticalFailureTimeout

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout

This policy setting configures the time in minutes before a detection in the "critically failed" state to moves to either the "additional action" state or the "cleared" state.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_CriticalFailureTimeout
Friendly Name	Configure time out for detections in critically failed state
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	CriticalFailureTimeout
ADMX File Name	WindowsDefender.admx

Reporting_DisableEnhancedNotifications

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications

Use this policy setting to specify if you want Microsoft Defender Antivirus enhanced notifications to display on clients.

• If you disable or don't configure this setting, Microsoft Defender Antivirus enhanced notifications will display on clients.

• If you enable this setting, Microsoft Defender Antivirus enhanced notifications won't display on clients.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_DisableEnhancedNotifications
Friendly Name	Turn off enhanced notifications
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	DisableEnhancedNotifications
ADMX File Name	WindowsDefender.admx

Reporting_DisablegenericrePorts

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts

This policy setting allows you to configure whether or not Watson events are sent.

• If you enable or don't configure this setting, Watson events will be sent.

• If you disable this setting, Watson events won't be sent.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_DisablegenericrePorts
Friendly Name	Configure Watson events
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	DisableGenericRePorts
ADMX File Name	WindowsDefender.admx

Reporting_NonCriticalTimeout

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout

This policy setting configures the time in minutes before a detection in the "non-critically failed" state moves to the "cleared" state.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_NonCriticalTimeout
Friendly Name	Configure time out for detections in non-critical failed state
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	NonCriticalTimeout
ADMX File Name	WindowsDefender.admx

Reporting_RecentlyCleanedTimeout

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout

This policy setting configures the time in minutes before a detection in the "completed" state moves to the "cleared" state.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_RecentlyCleanedTimeout
Friendly Name	Configure time out for detections in recently remediated state
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	RecentlyCleanedTimeout
ADMX File Name	WindowsDefender.admx

Reporting_WppTracingComponents

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents

This policy configures Windows software trace preprocessor (WPP Software Tracing) components.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_WppTracingComponents
Friendly Name	Configure Windows software trace preprocessor components
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	WppTracingComponents
ADMX File Name	WindowsDefender.admx

Reporting_WppTracingLevel

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel

This policy allows you to configure tracing levels for Windows software trace preprocessor (WPP Software Tracing).

Tracing levels are defined as:

1 - Error 2 - Warning 3 - Info 4 - Debug.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Reporting_WppTracingLevel
Friendly Name	Configure WPP tracing level
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Reporting
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Reporting
Registry Value Name	WppTracingLevel
ADMX File Name	WindowsDefender.admx

Scan_AllowPause

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause

This policy setting allows you to manage whether or not end users can pause a scan in progress.

• If you enable or don't configure this setting, a new context menu will be added to the task tray icon to allow the user to pause a scan.

• If you disable this setting, users won't be able to pause scans.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_AllowPause
Friendly Name	Allow users to pause scan
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	AllowPause
ADMX File Name	WindowsDefender.admx

Scan_ArchiveMaxDepth

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth

This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0.

• If you enable this setting, archive files will be scanned to the directory depth level specified.

• If you disable or don't configure this setting, archive files will be scanned to the default directory depth level.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_ArchiveMaxDepth
Friendly Name	Specify the maximum depth to scan archive files
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	ArchiveMaxDepth
ADMX File Name	WindowsDefender.admx

Scan_ArchiveMaxSize

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize

This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning.

• If you enable this setting, archive files less than or equal to the size specified will be scanned.

• If you disable or don't configure this setting, archive files will be scanned according to the default value.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_ArchiveMaxSize
Friendly Name	Specify the maximum size of archive files to be scanned
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	ArchiveMaxSize
ADMX File Name	WindowsDefender.admx

Scan_DisableArchiveScanning

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning

This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files.

• If you enable or don't configure this setting, archive files will be scanned.

• If you disable this setting, archive files won't be scanned. However, archives are always scanned during directed scans.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableArchiveScanning
Friendly Name	Scan archive files
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableArchiveScanning
ADMX File Name	WindowsDefender.admx

Scan_DisableEmailScanning

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning

This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). Email scanning isn't supported on modern email clients.

• If you enable this setting, e-mail scanning will be enabled.

• If you disable or don't configure this setting, e-mail scanning will be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableEmailScanning
Friendly Name	Turn on e-mail scanning
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableEmailScanning
ADMX File Name	WindowsDefender.admx

Scan_DisableHeuristics

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics

This policy setting allows you to configure heuristics. Suspicious detections will be suppressed right before reporting to the engine client. Turning off heuristics will reduce the capability to flag new threats. It's recommended that you don't turn off heuristics.

• If you enable or don't configure this setting, heuristics will be enabled.

• If you disable this setting, heuristics will be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableHeuristics
Friendly Name	Turn on heuristics
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableHeuristics
ADMX File Name	WindowsDefender.admx

Scan_DisablePackedExeScanning

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning

This policy setting allows you to configure scanning for packed executables. It's recommended that this type of scanning remain enabled.

• If you enable or don't configure this setting, packed executables will be scanned.

• If you disable this setting, packed executables won't be scanned.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisablePackedExeScanning
Friendly Name	Scan packed executables
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisablePackedExeScanning
ADMX File Name	WindowsDefender.admx

Scan_DisableRemovableDriveScanning

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning

This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.

• If you enable this setting, removable drives will be scanned during any type of scan.

• If you disable or don't configure this setting, removable drives won't be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableRemovableDriveScanning
Friendly Name	Scan removable drives
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableRemovableDriveScanning
ADMX File Name	WindowsDefender.admx

Scan_DisableReparsePointScanning

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning

This policy setting allows you to configure reparse point scanning. If you allow reparse points to be scanned, there is a possible risk of recursion. However, the engine supports following reparse points to a maximum depth so at worst scanning could be slowed. Reparse point scanning is disabled by default and this is the recommended state for this functionality.

• If you enable this setting, reparse point scanning will be enabled.

• If you disable or don't configure this setting, reparse point scanning will be disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableReparsePointScanning
Friendly Name	Turn on reparse point scanning
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableReparsePointScanning
ADMX File Name	WindowsDefender.admx

Scan_DisableRestorePoint

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint

This policy setting allows you to create a system restore point on the computer on a daily basis prior to cleaning.

• If you enable this setting, a system restore point will be created.

• If you disable or don't configure this setting, a system restore point won't be created.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableRestorePoint
Friendly Name	Create a system restore point
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableRestorePoint
ADMX File Name	WindowsDefender.admx

Scan_DisableScanningMappedNetworkDrivesForFullScan

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan

This policy setting allows you to configure scanning mapped network drives.

• If you enable this setting, mapped network drives will be scanned.

• If you disable or don't configure this setting, mapped network drives won't be scanned.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableScanningMappedNetworkDrivesForFullScan
Friendly Name	Run full scan on mapped network drives
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableScanningMappedNetworkDrivesForFullScan
ADMX File Name	WindowsDefender.admx

Scan_DisableScanningNetworkFiles

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles

This policy setting allows the scanning of network files using on access protection. The default is enabled. Recommended to remain enabled in most cases.

• If you enable or don't configure this setting, network files will be scanned.

• If you disable this setting, network files won't be scanned.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_DisableScanningNetworkFiles
Friendly Name	Configure scanning of network files
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	DisableScanningNetworkFiles
ADMX File Name	WindowsDefender.admx

Scan_LocalSettingOverrideAvgCPULoadFactor

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor

This policy setting configures a local override for the configuration of maximum percentage of CPU utilization during scan. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LocalSettingOverrideAvgCPULoadFactor
Friendly Name	Configure local setting override for maximum percentage of CPU utilization
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LocalSettingOverrideAvgCPULoadFactor
ADMX File Name	WindowsDefender.admx

Scan_LocalSettingOverrideScanParameters

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters

This policy setting configures a local override for the configuration of the scan type to use during a scheduled scan. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LocalSettingOverrideScanParameters
Friendly Name	Configure local setting override for the scan type to use for a scheduled scan
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LocalSettingOverrideScanParameters
ADMX File Name	WindowsDefender.admx

Scan_LocalSettingOverrideScheduleDay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay

This policy setting configures a local override for the configuration of scheduled scan day. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LocalSettingOverrideScheduleDay
Friendly Name	Configure local setting override for schedule scan day
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LocalSettingOverrideScheduleDay
ADMX File Name	WindowsDefender.admx

Scan_LocalSettingOverrideScheduleQuickScantime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime

This policy setting configures a local override for the configuration of scheduled quick scan time. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LocalSettingOverrideScheduleQuickScantime
Friendly Name	Configure local setting override for scheduled quick scan time
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LocalSettingOverrideScheduleQuickScanTime
ADMX File Name	WindowsDefender.admx

Scan_LocalSettingOverrideScheduleTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime

This policy setting configures a local override for the configuration of scheduled scan time. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LocalSettingOverrideScheduleTime
Friendly Name	Configure local setting override for scheduled scan time
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LocalSettingOverrideScheduleTime
ADMX File Name	WindowsDefender.admx

Scan_LowCpuPriority

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority

This policy setting allows you to enable or disable low CPU priority for scheduled scans.

• If you enable this setting, low CPU priority will be used during scheduled scans.

• If you disable or don't configure this setting, not changes will be made to CPU priority for scheduled scans.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_LowCpuPriority
Friendly Name	Configure low CPU priority for scheduled scans
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	LowCpuPriority
ADMX File Name	WindowsDefender.admx

Scan_MissedScheduledScanCountBeforeCatchup

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup

This policy setting allows you to define the number of consecutive scheduled scans that can be missed after which a catch-up scan will be forced. By default, the value of this setting is 2 consecutive scheduled scans.

• If you enable this setting, a catch-up scan will occur after the specified number consecutive missed scheduled scans.

• If you disable or don't configure this setting, a catch-up scan will occur after the 2 consecutive missed scheduled scans.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_MissedScheduledScanCountBeforeCatchup
Friendly Name	Define the number of days after which a catch-up scan is forced
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	MissedScheduledScanCountBeforeCatchup
ADMX File Name	WindowsDefender.admx

Scan_PurgeItemsAfterDelay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay

This policy setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and won't be automatically removed. By default, the value is set to 30 days.

• If you enable this setting, items will be removed from the scan history folder after the number of days specified.

• If you disable or don't configure this setting, items will be kept in the scan history folder for the default number of days.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_PurgeItemsAfterDelay
Friendly Name	Turn on removal of items from scan history folder
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	PurgeItemsAfterDelay
ADMX File Name	WindowsDefender.admx

Scan_QuickScanInterval

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval

This policy setting allows you to specify an interval at which to perform a quick scan. The time value is represented as the number of hours between quick scans. Valid values range from 1 (every hour) to 24 (once per day). If set to zero, interval quick scans won't occur. By default, this setting is set to 0.

• If you enable this setting, a quick scan will run at the interval specified.

• If you disable or don't configure this setting, quick scan controlled by this config won't be run.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_QuickScanInterval
Friendly Name	Specify the interval to run quick scans per day
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	QuickScanInterval
ADMX File Name	WindowsDefender.admx

Scan_ScanOnlyIfIdle

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle

This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use.

• If you enable or don't configure this setting, scheduled scans will only run when the computer is on but not in use.

• If you disable this setting, scheduled scans will run at the scheduled time.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_ScanOnlyIfIdle
Friendly Name	Start the scheduled scan only when computer is on but not in use
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	ScanOnlyIfIdle
ADMX File Name	WindowsDefender.admx

Scan_ScheduleDay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay

This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all.

This setting can be configured with the following ordinal number values:

(0x0) Every Day (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never (default)

• If you enable this setting, a scheduled scan will run at the frequency specified.

• If you disable or don't configure this setting, a scheduled scan will run at a default frequency.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_ScheduleDay
Friendly Name	Specify the day of the week to run a scheduled scan
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	ScheduleDay
ADMX File Name	WindowsDefender.admx

Scan_ScheduleTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime

This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing.

• If you enable this setting, a scheduled scan will run at the time of day specified.

• If you disable or don't configure this setting, a scheduled scan will run at a default time.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Scan_ScheduleTime
Friendly Name	Specify the time of day to run a scheduled scan
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Scan
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Scan
Registry Value Name	ScheduleTime
ADMX File Name	WindowsDefender.admx

ServiceKeepAlive

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive

This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware security intelligence is disabled. It's recommended that this setting remain disabled.

• If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware security intelligence is disabled.

• If you disable or don't configure this setting, the antimalware service will be stopped when both antivirus and antispyware security intelligence is disabled. If the computer is restarted, the service will be started if it's set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware security intelligence is enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	ServiceKeepAlive
Friendly Name	Allow antimalware service to remain running always
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus
Registry Key Name	Software\Policies\Microsoft\Windows Defender
Registry Value Name	ServiceKeepAlive
ADMX File Name	WindowsDefender.admx

SignatureUpdate_ASSignatureDue

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue

This policy setting allows you to define the number of days that must pass before spyware security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 7 days.

• If you enable this setting, spyware security intelligence will be considered out of date after the number of days specified have passed without an update.

• If you disable or don't configure this setting, spyware security intelligence will be considered out of date after the default number of days have passed without an update.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_ASSignatureDue
Friendly Name	Define the number of days before spyware security intelligence is considered out of date
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	ASSignatureDue
ADMX File Name	WindowsDefender.admx

SignatureUpdate_AVSignatureDue

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue

This policy setting allows you to define the number of days that must pass before virus security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 7 days.

• If you enable this setting, virus security intelligence will be considered out of date after the number of days specified have passed without an update.

• If you disable or don't configure this setting, virus security intelligence will be considered out of date after the default number of days have passed without an update.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_AVSignatureDue
Friendly Name	Define the number of days before virus security intelligence is considered out of date
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	AVSignatureDue
ADMX File Name	WindowsDefender.admx

SignatureUpdate_DefinitionUpdateFileSharesSources

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources

This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: "{\\unc1 | \\unc2 }". The list is empty by default.

• If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list won't be contacted.

• If you disable or don't configure this setting, the list will remain empty by default and no sources will be contacted.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_DefinitionUpdateFileSharesSources
Friendly Name	Define file shares for downloading security intelligence updates
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
ADMX File Name	WindowsDefender.admx

SignatureUpdate_DisableScanOnUpdate

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate

This policy setting allows you to configure the automatic scan which starts after a security intelligence update has occurred.

• If you enable or don't configure this setting, a scan will start following a security intelligence update.

• If you disable this setting, a scan won't start following a security intelligence update.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_DisableScanOnUpdate
Friendly Name	Turn on scan after security intelligence update
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	DisableScanOnUpdate
ADMX File Name	WindowsDefender.admx

SignatureUpdate_DisableScheduledSignatureUpdateonBattery

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery

This policy setting allows you to configure security intelligence updates when the computer is running on battery power.

• If you enable or don't configure this setting, security intelligence updates will occur as usual regardless of power state.

• If you disable this setting, security intelligence updates will be turned off while the computer is running on battery power.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_DisableScheduledSignatureUpdateonBattery
Friendly Name	Allow security intelligence updates when running on battery power
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	DisableScheduledSignatureUpdateOnBattery
ADMX File Name	WindowsDefender.admx

SignatureUpdate_DisableUpdateOnStartupWithoutEngine

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine

This policy setting allows you to configure security intelligence updates on startup when there is no antimalware engine present.

• If you enable or don't configure this setting, security intelligence updates will be initiated on startup when there is no antimalware engine present.

• If you disable this setting, security intelligence updates won't be initiated on startup when there is no antimalware engine present.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_DisableUpdateOnStartupWithoutEngine
Friendly Name	Initiate security intelligence update on startup
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	DisableUpdateOnStartupWithoutEngine
ADMX File Name	WindowsDefender.admx

SignatureUpdate_FallbackOrder

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder

This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: "InternalDefinitionUpdateServer", "MicrosoftUpdateServer", "MMPC", and "FileShares".

For Example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC }

• If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list won't be contacted.

• If you disable or don't configure this setting, security intelligence update sources will be contacted in a default order.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_FallbackOrder
Friendly Name	Define the order of sources for downloading security intelligence updates
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
ADMX File Name	WindowsDefender.admx

SignatureUpdate_ForceUpdateFromMU

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU

This policy setting allows you to enable download of security intelligence updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update.

• If you enable this setting, security intelligence updates will be downloaded from Microsoft Update.

• If you disable or don't configure this setting, security intelligence updates will be downloaded from the configured download source.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_ForceUpdateFromMU
Friendly Name	Allow security intelligence updates from Microsoft Update
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	ForceUpdateFromMU
ADMX File Name	WindowsDefender.admx

SignatureUpdate_RealtimeSignatureDelivery

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery

This policy setting allows you to enable real-time security intelligence updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest security intelligence update has security intelligence for a threat involving that file, the service will receive all of the latest security intelligence for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work.

• If you enable or don't configure this setting, real-time security intelligence updates will be enabled.

• If you disable this setting, real-time security intelligence updates will disabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_RealtimeSignatureDelivery
Friendly Name	Allow real-time security intelligence updates based on reports to Microsoft MAPS
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	RealtimeSignatureDelivery
ADMX File Name	WindowsDefender.admx

SignatureUpdate_ScheduleDay

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay

This policy setting allows you to specify the day of the week on which to check for security intelligence updates. The check can also be configured to run every day or to never run at all.

This setting can be configured with the following ordinal number values:

(0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never.

• If you enable this setting, the check for security intelligence updates will occur at the frequency specified.

• If you disable or don't configure this setting, the check for security intelligence updates will occur at a default frequency.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_ScheduleDay
Friendly Name	Specify the day of the week to check for security intelligence updates
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	ScheduleDay
ADMX File Name	WindowsDefender.admx

SignatureUpdate_ScheduleTime

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime

This policy setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring.

• If you enable this setting, the check for security intelligence updates will occur at the time of day specified.

• If you disable or don't configure this setting, the check for security intelligence updates will occur at the default time.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_ScheduleTime
Friendly Name	Specify the time to check for security intelligence updates
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	ScheduleTime
ADMX File Name	WindowsDefender.admx

SignatureUpdate_SharedSignaturesLocation

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation

This policy setting allows you to define the security intelligence location for VDI-configured computers.

If you disable or don't configure this setting, security intelligence will be referred from the default local source.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_SharedSignaturesLocation
Friendly Name	Define security intelligence location for VDI clients.
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
ADMX File Name	WindowsDefender.admx

SignatureUpdate_SignatureDisableNotification

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification

This policy setting allows you to configure the antimalware service to receive notifications to disable individual security intelligence in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable security intelligence that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work.

• If you enable this setting or don't configure, the antimalware service will receive notifications to disable security intelligence.

• If you disable this setting, the antimalware service won't receive notifications to disable security intelligence.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_SignatureDisableNotification
Friendly Name	Allow notifications to disable security intelligence based reports to Microsoft MAPS
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	SignatureDisableNotification
ADMX File Name	WindowsDefender.admx

SignatureUpdate_SignatureUpdateCatchupInterval

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval

This policy setting allows you to define the number of days after which a catch-up security intelligence update will be required. By default, the value of this setting is 1 day.

• If you enable this setting, a catch-up security intelligence update will occur after the specified number of days.

• If you disable or don't configure this setting, a catch-up security intelligence update will be required after the default number of days.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_SignatureUpdateCatchupInterval
Friendly Name	Define the number of days after which a catch-up security intelligence update is required
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	SignatureUpdateCatchupInterval
ADMX File Name	WindowsDefender.admx

SignatureUpdate_UpdateOnStartup

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup

This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur immediately after service startup.

• If you enable this setting, a check for new security intelligence will occur after service startup.

• If you disable this setting or don't configure this setting, a check for new security intelligence won't occur after service startup.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SignatureUpdate_UpdateOnStartup
Friendly Name	Check for the latest virus and spyware security intelligence on startup
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Signature Updates
Registry Value Name	UpdateOnStartUp
ADMX File Name	WindowsDefender.admx

Spynet_LocalSettingOverrideSpynetReporting

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy.

• If you enable this setting, the local preference setting will take priority over Group Policy.

• If you disable or don't configure this setting, Group Policy will take priority over the local preference setting.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Spynet_LocalSettingOverrideSpynetReporting
Friendly Name	Configure local setting override for reporting to Microsoft MAPS
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > MAPS
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Spynet
Registry Value Name	LocalSettingOverrideSpynetReporting
ADMX File Name	WindowsDefender.admx

SpynetReporting

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/SpynetReporting

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections.

You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft won't use this information to identify you or contact you.

Possible options are:

(0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership.

Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful.

Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer.

• If you enable this setting, you'll join Microsoft MAPS with the membership specified.

• If you disable or don't configure this setting, you won't join Microsoft MAPS.

In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	SpynetReporting
Friendly Name	Join Microsoft MAPS
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > MAPS
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Spynet
Registry Value Name	SpynetReporting
ADMX File Name	WindowsDefender.admx

Threats_ThreatIdDefaultAction

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction

This policy setting customize which remediation action will be taken for each listed Threat ID when it's detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken.

Valid remediation action values are:

2 = Quarantine 3 = Remove 6 = Ignore.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	Threats_ThreatIdDefaultAction
Friendly Name	Specify threats upon which default action should not be taken when detected
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Threats
Registry Key Name	Software\Policies\Microsoft\Windows Defender\Threats
Registry Value Name	Threats_ThreatIdDefaultAction
ADMX File Name	WindowsDefender.admx

UX_Configuration_CustomDefaultActionToastString

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	UX_Configuration_CustomDefaultActionToastString
ADMX File Name	WindowsDefender.admx

UX_Configuration_Notification_Suppress

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress

Use this policy setting to specify if you want Microsoft Defender Antivirus notifications to display on clients.

• If you disable or don't configure this setting, Microsoft Defender Antivirus notifications will display on clients.

• If you enable this setting, Microsoft Defender Antivirus notifications won't display on clients.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	UX_Configuration_Notification_Suppress
Friendly Name	Suppress all notifications
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Client Interface
Registry Key Name	Software\Policies\Microsoft\Windows Defender\UX Configuration
Registry Value Name	Notification_Suppress
ADMX File Name	WindowsDefender.admx

UX_Configuration_SuppressRebootNotification

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification

This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode).

If you enable this setting AM UI won't show reboot notifications.

Note

Changes to this setting are not applied when tamper protection is enabled.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	UX_Configuration_SuppressRebootNotification
Friendly Name	Suppresses reboot notifications
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Client Interface
Registry Key Name	Software\Policies\Microsoft\Windows Defender\UX Configuration
Registry Value Name	SuppressRebootNotification
ADMX File Name	WindowsDefender.admx

UX_Configuration_UILockdown

Scope	Editions	Applicable OS
✅ Device ❌ User	✅ Pro ✅ Enterprise ✅ Education ✅ Windows SE ✅ IoT Enterprise / IoT Enterprise LTSC	✅ Windows 10, version 2004 with KB5005101 [10.0.19041.1202] and later ✅ Windows 10, version 20H2 with KB5005101 [10.0.19042.1202] and later ✅ Windows 10, version 21H1 with KB5005101 [10.0.19043.1202] and later ✅ Windows 11, version 21H2 [10.0.22000] and later

./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown

This policy setting allows you to configure whether or not to display AM UI to the users.

If you enable this setting AM UI won't be available to users.

Description framework properties:

Property name	Property value
Format	chr (string)
Access Type	Add, Delete, Get, Replace

Tip

This is an ADMX-backed policy and requires SyncML format for configuration. For an example of SyncML format, refer to Enabling a policy.

ADMX mapping:

Name	Value
Name	UX_Configuration_UILockdown
Friendly Name	Enable headless UI mode
Location	Computer Configuration
Path	Windows Components > Microsoft Defender Antivirus > Client Interface
Registry Key Name	Software\Policies\Microsoft\Windows Defender\UX Configuration
Registry Value Name	UILockdown
ADMX File Name	WindowsDefender.admx

Related articles

Policy configuration service provider