Monitor file and program activity on your computer This scan operates in addition to the Windows Defender SmartScreen filter, which scans files before and during downloading. Scan all downloaded files and attachmentsĭownloaded files and attachments are automatically scanned. The antivirus engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity. Real-time protection policy settings Setting In the Scan details pane on right, double-click Turn on heuristics, and set it to Enabled.

Repeat the previous steps for each setting in the table.Ĭonfigure the Microsoft Defender Antivirus scanning policy setting, as follows:įrom the Microsoft Defender Antivirus tree on left pane, select Scan. In the Real-time Protection details pane on right, double-click the policy setting as specified in Real-time protection policy settings (later in this article).Ĭonfigure the setting as appropriate, and select OK. Or, from the Microsoft Defender Antivirus tree on left pane, select Real-time Protection.

In the Microsoft Defender Antivirus details pane, double-click Real-time Protection. In the Microsoft Defender Antivirus details pane on right, double-click Allow antimalware service to start up with normal priority, and set it to Enabled.Ĭonfigure the Microsoft Defender Antivirus real-time protection policy settings, as follows: In the left pane of Local Group Policy Editor, expand the tree to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.Ĭonfigure the Microsoft Defender Antivirus antimalware service policy setting. Under Best match, select Edit group policy to launch Local Group Policy Editor. In your Windows 10 or Windows 11 taskbar search box, type gpedit. Open Local Group Policy Editor, as follows: To enable and configure always-on protection:

You can use Local Group Policy Editor to enable and configure Microsoft Defender Antivirus always-on protection settings. Enable and configure always-on protection in Group Policy These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as autostart extensibility points, or ASEPs), and other changes to the file system or file structure.

Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.

How to turn on microsoft defender