Monitor file and program activity on your computer
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
This machine-wide registry value controls Microsoft Defender Antivirus on-access protection. Defender monitors file and program activity and can inspect files when they are opened, read, written, or modified. This continuous protection complements scheduled and on-demand antivirus scans.
The value uses the REG_DWORD data type. Because DisableOnAccessProtection is negatively named, its data has the following meaning:
0enables monitoring of file and program activity.1disables that monitoring.
If the value is absent, the corresponding policy is not configured. Microsoft documents file and program activity monitoring as enabled in that state.
Notes
Security
A value of 1 removes a protection layer that can detect threats when files are accessed. Malicious or potentially unwanted content might therefore not be inspected and blocked at the point when a process accesses it. Other Defender capabilities or a later scan might still detect the content, but they do not fully replace on-access inspection.
This setting does not by itself turn off all real-time protection or Microsoft Defender Antivirus. The real-time monitoring service, behavior monitoring, downloaded-file and attachment scanning, and script scanning are controlled by separate settings.
Notes
The setting is effective only in conjunction with an active Microsoft Defender Antivirus installation and the other required real-time protection components. A separate scan-direction policy determines which inbound or outbound file activity is monitored.
When tamper protection is enabled, changes to this setting might be ignored.
Microsoft documentation
Microsoft Learn: Policy CSP – Defender – AllowOnAccessProtection
Microsoft Learn: Enable and configure Microsoft Defender Antivirus always-on protection
Microsoft: WindowsDefender.admx