Enable and configure Microsoft Defender Antivirus always-on protection

Always-on protection in Microsoft Defender Antivirus uses real-time protection, behavior monitoring, and heuristics to detect suspicious and malicious activity. Security administrators can configure these capabilities on Windows devices by using Microsoft Intune, the Microsoft Defender portal, Microsoft Configuration Manager, or Group Policy. You can also use PowerShell or the Windows Security app. Review the supported operating systems before you begin.

Prerequisites

Supported operating systems

The following operating systems support always-on protection:

• Windows

To use the Intune procedure, enroll Windows devices in Intune.

Before using Configuration Manager, configure it for Endpoint Protection. For more information, see Configure Endpoint Protection in Configuration Manager.

Configure always-on protection settings in Microsoft Intune

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and it isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. If you don't have Intune, you can use any of the other methods in this article. For more information, see Microsoft Intune licensing.

To configure always-on protection settings in Microsoft Intune, use an endpoint security Antivirus policy. For detailed instructions, see Create endpoint security policies or Modify existing policies (links open new tabs in the Intune documentation).

When you create the policy, use these specific settings:

• Policy type: Select Manage > Antivirus on the Endpoint security | Overview page.
• Platform: Select Windows.
• Profile: Select Microsoft Defender Antivirus.

When you create or modify the policy, use these specific settings on the Configuration settings tab:

• In the Defender section, configure the following settings:
  • Allow Real-Time Monitoring: Select Allowed.
  • Allow On Access Protection: Select Allowed.
  • Real Time Scan Direction: Select Monitor all files (bi-directional).
  • Allow behavior monitoring: Select Allowed.

The Microsoft Defender Antivirus profile doesn't include a separate setting for heuristics. Heuristics are part of real-time protection. For descriptions of all available Windows settings, options, defaults, recommendations, and CSP mappings, see Configure Microsoft Defender Antivirus using Microsoft Intune.

Configure always-on protection settings in the Microsoft Defender portal

If your organization manages endpoint security policies in the Microsoft Defender portal, use a Microsoft Defender Antivirus policy to configure always-on protection.

For detailed instructions, see Create an endpoint security policy or Edit an endpoint security policy (links open new tabs).

When you create the policy on the Endpoint security policies page in the Microsoft Defender portal at https://security.microsoft.com/policy-inventory, use these specific settings:

• Select platform: Select Windows.
• Select template: Select Microsoft Defender Antivirus.

When you create or modify the policy, use these specific settings on the Configuration settings tab:

• In the Defender section, configure the following settings:
  • Allow Real-Time Monitoring: Select Allowed.
  • Allow On Access Protection: Select Allowed.
  • Real Time Scan Direction: Select Monitor all files (bi-directional).
  • Allow behavior monitoring: Select Allowed.

The Microsoft Defender Antivirus template doesn't include a separate setting for heuristics. Heuristics are part of real-time protection.

Configure always-on protection settings in Microsoft Configuration Manager

For instructions to create and deploy an antimalware policy, see Endpoint Protection antimalware policies in Configuration Manager.

In the Real-time protection settings of the antimalware policy, configure the following settings:

• Enable real-time protection: Select Yes.
• Monitor file and program activity on your computer: Select Yes.
• Scan system files: Select Scan incoming and outgoing files.
• Enable behavior monitoring: Select Yes.

Configure always-on protection settings in Group Policy

You can use Group Policy to manage some Microsoft Defender Antivirus settings. If tamper protection is enabled in your organization, any changes made to tamper-protected settings are ignored. You can't turn off tamper protection by using Group Policy.

To temporarily change tamper-protected settings for testing or diagnostics, use troubleshooting mode. After troubleshooting mode ends, the settings return to their configured values. To make permanent changes, use a management tool that supports changes to tamper-protected settings, such as Intune.

The following procedure applies to Windows devices.

1. In Centralized Group Policy, open the Group Policy Management Console (GPMC) on your Group Policy management computer.

2. In the GPMC console tree, expand Group Policy Objects in the forest and domain containing the Group Policy Object (GPO) you want to edit.

3. Right-click the GPO, and then select Edit.

4. In the Group Policy Management Editor, go to Computer configuration > Administrative templates > Windows components > Microsoft Defender Antivirus.

5. In the details pane of Microsoft Defender Antivirus, the folders used to configure always-on protection are:

   • Real-time Protection: Configure real-time protection settings.
   • Scan: Turn on heuristics.

   To open and configure a setting, use any of the following methods:

   • Double-click the setting.
   • Right-click the setting, and then select Edit.
   • Select the setting, and then select Action > Edit.

Configure the settings as described in the following subsections.

Configure real-time protection settings in Group Policy

If a setting described in this article isn't available in Group Policy Management Editor, update the Administrative Templates in your Group Policy Central Store. The Central Store isn't updated automatically. For instructions, see How to create and manage the Central Store for Group Policy Administrative Templates in Windows.

Configure the following policies to turn on real-time and behavior monitoring:

1. Go to Microsoft Defender Antivirus > Real-time Protection.
2. In the details pane of Real-time Protection, select a policy setting to view its description and supported options in the help pane. For a list of the settings and links to related guidance, see Group Policy settings and resources.
3. Open each policy setting in the table, configure the specified value, and then select OK.

Turn on heuristics in Group Policy

Enable the heuristics policy in the Scan folder:

1. Go to Microsoft Defender Antivirus > Scan.
2. In the details pane of Scan, open Turn on heuristics.
3. Select Enabled, and then select OK.

Disable real-time protection in Group Policy

To disable real-time protection by using Group Policy:

1. Go to Microsoft Defender Antivirus > Real-time Protection.
2. In the details pane of Real-time Protection, open Turn off real-time protection.
3. Select Enabled, and then select OK.

Configure always-on protection settings using PowerShell

Run the commands in an elevated PowerShell session (a PowerShell window you opened by selecting Run as administrator).

The following command turns on real-time monitoring and behavior monitoring, and configures Microsoft Defender Antivirus to scan incoming and outgoing files:

Set-MpPreference -DisableRealtimeMonitoring $false -DisableBehaviorMonitoring $false -RealTimeScanDirection Both

The following command displays the configured values:

Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring, RealTimeScanDirection

Verify that DisableRealtimeMonitoring and DisableBehaviorMonitoring are set to False, and RealTimeScanDirection is set to 0.

For detailed syntax and parameter information, see Set-MpPreference and Get-MpPreference.

Turn on real-time protection in the Windows Security app

The Windows Security app lets you turn on real-time protection on an individual device. It doesn't provide separate controls for all the always-on protection settings described in this article.

To turn on real-time protection in the Windows Security app:

1. Open the Windows Security app and select Virus & threat protection.
2. On the Virus & Threat protection page, select Manage settings in the Virus & threat protection settings section.
3. On the Virus & threat protection settings page, slide the Real-time protection toggle to On.

If your organization manages real-time protection, the Real-time protection setting might be unavailable. If you turn off real-time protection, it turns on again automatically after a short delay.

For more information, see Microsoft Defender Antivirus in the Windows Security app.

Related content

• Configure behavioral, heuristic, and real-time protection
• Microsoft Defender Antivirus in Windows 10

Other platforms

If you're looking for antivirus-related information for other platforms, see:

• Set preferences for Microsoft Defender for Endpoint on macOS
• Microsoft Defender for Endpoint on Mac
• macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune
• Set preferences for Microsoft Defender for Endpoint on Linux
• Microsoft Defender for Endpoint on Linux
• Configure Defender for Endpoint on Android features
• Configure Microsoft Defender for Endpoint on iOS features