[REQ-END-057] Disable Real-Time Monitoring and Behavior Monitoring Override

Target Scope

Applicable Systems: Tier 2 client workstations and member servers.
Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above).

Implementation Details

Priority: High
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection
- Registry Location:
  - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
    - DisableRealtimeMonitoring = 0 (REG_DWORD)
  - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
    - DisableBehaviorMonitoring = 0 (REG_DWORD)
  - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
    - DisableIOAVProtection = 0 (REG_DWORD)
  - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
    - DisableScriptScanning = 0 (REG_DWORD)

Rationale

Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected.

Legacy Impact & Compatibility

Negligible operational impact. Real-time scanning introduces standard CPU overhead during file read/write operations.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection
Set 'Turn off real-time protection' to 'Disabled'
Set 'Turn on behavior monitoring' to 'Enabled'
Set 'Scan all downloaded files and attachments' to 'Enabled'
Set 'Turn on script scanning' to 'Enabled'

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Download Script: Configure-DefenderRtp.ps1

# Configure-DefenderRtp.ps1
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
Set-MpPreference -DisableScriptScanning $false

To audit the hardening status: Download Script: Get-DefenderRtpStatus.ps1

# Get-DefenderRtpStatus.ps1
$Pref = Get-MpPreference
if ($Pref.DisableRealtimeMonitoring -eq $false -and $Pref.DisableBehaviorMonitoring -eq $false -and $Pref.DisableIOAVProtection -eq $false -and $Pref.DisableScriptScanning -eq $false) {
    Write-Output "Compliant"
    exit 0
} else {
    Write-Output "Non-Compliant"
    exit 1
}

Sources & Compliance References

CIS Microsoft Windows 10 Benchmark: Section 18.9 (Windows Defender Antivirus configuration parameters)
ANSSI Active Directory Hardening Guide: Protective controls baselines on client workstations

REQ-END-057 - Disable Real-Time Monitoring and Behavior Monitoring Override