Description:

Real-time protection is the always-on scanning engine of Microsoft Defender Antivirus. It checks files, downloads, scripts and running programs the moment they are opened or run, and blocks malware before it can execute. Threat detection is backed by behavior monitoring, cloud-delivered protection and regular security intelligence (signature) updates. 


Rationale:

  • Detects and blocks viruses, ransomware, spyware and other malware as soon as they appear

  • Stops threats before they run, rather than only finding them in a later scan

  • Uses cloud-delivered protection to catch new and unknown threats within seconds

  • Meets compliance requirements for anti-malware protection (ISO 27001, SOC 2, PCI DSS, CIS Benchmarks)


Impact:

  • Continuous protection against malware with no change to normal user work

  • May use a small amount of CPU and disk while scanning files

  • Can occasionally flag a legitimate file or tool, which then needs to be reviewed and allowed

  • Turning it off leaves the laptop exposed to malware until it is turned back on


Default Value:

Real-time protection is turned on by default when Microsoft Defender Antivirus is the active antivirus. When a third-party antivirus (such as Avast) is installed, Microsoft Defender switches itself off and the third-party product provides real-time protection instead.


Pre-requisites:

  • Local Administrator rights

  • Windows 10 or Windows 11

  • Microsoft Defender Antivirus as the active antivirus (no other antivirus installed)

  • Internet access for cloud-delivered protection and security intelligence updates

  • Tamper Protection settings known: when it is On, some settings can only be changed from the Windows Security app, Intune or Defender portal, not PowerShell


Test Plan

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security.

  3. Under Security, click Windows Security.

  4. Click Virus & threat protection.

  5. Under Virus & threat protection settings, click Manage settings.

  6. Confirm these toggles are On: Real-time protection, Cloud-delivered protection, Automatic sample submission and Tamper Protection.

  7. Go back to Virus & threat protection and, under Virus & threat protection updates, confirm the security intelligence was updated recently.

  8. If any toggle is Off, follow the Implementation Plan.

Note: If Virus & threat protection shows a third-party antivirus (for example Avast Antivirus is turned on), the Microsoft Defender settings won't appear. Real-time protection is then provided by that product. For Avast: open Avast → click the shield icon in the left bar → Core Shields → confirm File Shield, Behavior Shield, Web Shield and Mail Shield are On.


PowerShell

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The prompt shows   and the window title starts with Administrator:.

  4. Check the protection status:

Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, OnAccessProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated

  1. Check the cloud protection settings:

  Get-MpPreference | Select-Object DisableRealtimeMonitoring, MAPSReporting, SubmitSamplesConsent

  1. Expected result: all Enabled values and IsTamperProtected are True, AntivirusSignatureLastUpdated is within the last few days, DisableRealtimeMonitoring is False, MAPSReporting is 2 and SubmitSamplesConsent is 1 or 3. If not, follow the Implementation Plan.


Implementation Plan

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security and select Virus & threat protection.

  1. Under Virus & threat protection settings, click Manage settings.

  1. Turn Real-time protection On and click Yes on the User Account Control prompt.

  2. Turn Cloud-delivered protection, Automatic sample submission and Tamper Protection On.

  1. Go back to Virus & threat protection. Under Virus & threat protection updates, click Protection updates → Check for updates.

  2. Under Current threats, click Quick scan to run a first threat scan.

  3. Confirm the scan shows No current threats and all toggles show On.


PowerShell

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The prompt shows   and the window title starts with Administrator:.

  4. Turn on real-time protection, behavior monitoring and download/script scanning:

  Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring 
   $false -DisableIOAVProtection $false -DisableScriptScanning $false

  1. Turn on cloud-delivered protection and automatic sample submission:

  Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples

  1. Update security intelligence (signatures):

  Update-MpSignature

  1. Run a quick threat scan:

  Start-MpScan -ScanType QuickScan

  1. Check for any detected threats:

  Get-MpThreatDetection

  1. Confirm the settings. All values should be True:

  Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, 
   BehaviorMonitorEnabled, IoavProtectionEnabled, IsTamperProtected

Note: Tamper Protection can't be turned on with PowerShell. Use step 7 of the UI method, Intune or the Microsoft Defender portal.


Backout Plan

Turning off real-time protection should only be temporary, for example to troubleshoot an app that is wrongly blocked. Windows turns it back on automatically after a short time or a restart.

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security.

  3. Under Security, click Windows Security → Virus & threat protection.

  4. Under Virus & threat protection settings, click Manage settings.

  5. Turn Real-time protection Off and click Yes on the User Account Control prompt.

  6. If only one file or app is wrongly blocked, add it under Exclusions → Add or remove exclusions instead of turning protection off.


PowerShell:

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The prompt shows   and the window title starts with Administrator:.

  4. Turn off real-time protection (Tamper Protection must be turned off first in the UI, or this command is ignored):

  Set-MpPreference -DisableRealtimeMonitoring $true

  1. Turn it back on once troubleshooting is done:

  Set-MpPreference -DisableRealtimeMonitoring $false

  1. Confirm the setting:

  Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled

Reference