Microsoft Defender Antivirus Real-Time Protection is one of the main security features available through the Windows Security app in Windows 10 and Windows 11. It continuously monitors files, programs, and activity on your PC and can respond when it detects a potential threat. Microsoft recommends keeping real-time protection enabled for ongoing protection against malware.
If you are trying to configure Windows Defender Antimalware Real-Time Protection, you do not normally need complicated commands or third-party security tools. You can manage the primary settings directly through Windows Security.
Let’s learn the process in detail!
Configure Windows Defender Antimalware Real-Time Protection
To configure Windows Defender Antimalware Real-Time Protection:
- Open Start and search for Windows Security.
- Select Virus & threat protection.
- Under Virus & threat protection settings, select Manage settings.
- Find Real-time protection and switch it On.
- Keep Cloud-delivered protection enabled for additional protection.
- Keep Automatic sample submission enabled when appropriate.
- Check Tamper protection and keep it enabled to help prevent unauthorized changes to important security settings.
- If the Real-time protection switch is unavailable, check whether another antivirus program or an organizational policy is controlling Microsoft Defender.
Step 1: Open Windows Security
Start by opening the Windows Security app. Select Start, type Windows Security into the search box, and then open the matching application.
Windows Security is the central place where Windows provides access to Microsoft Defender Antivirus and several other security features. Microsoft states that the app is available on both Windows 10 and Windows 11.
If you cannot immediately find it, use the Start menu search rather than looking through every Settings category. Once Windows Security opens, you will see several protection areas. For this task, you are mainly interested in Virus & threat protection.
Step 2: Open Virus & Threat Protection
Inside Windows Security, select Virus & threat protection. This page gives you access to your antivirus status, recent threat information, scanning options, and Microsoft Defender settings.
Look for the Virus & threat protection settings section. Under this section, select Manage settings. This opens the configuration area where you can control Real-time protection and several related Defender options.
If your screen looks slightly different from the instructions, do not worry. Windows updates can change the appearance of Windows Security, but the Virus & threat protection and Manage settings areas remain the important locations to look for.
Step 3: Turn On Real-Time Protection
Now locate Real-time protection. If the switch is turned off, select it to change the setting to On.
Real-time protection continuously monitors your PC for potential threats. Microsoft explains that it can scan files and programs as they are accessed or executed, helping detect suspicious activity before it causes damage.
For everyday Windows use, leaving Real-time protection turned on is the recommended configuration. When you temporarily turn it off, files you open or download are not checked by real-time protection during that period. Microsoft also notes that Windows can automatically turn real-time protection back on after a short time.
Step 4: Configure Cloud-Delivered Protection
After configuring Real-time protection, look for Cloud-delivered protection.
This setting works alongside Microsoft Defender’s other protection mechanisms and can help Defender respond to threats using Microsoft’s cloud-based security capabilities. Microsoft recommends keeping Cloud-delivered protection enabled for optimal protection.
For most home users, there is little reason to turn this feature off. If you are troubleshooting a specific application, check whether the application’s developer has provided a legitimate security-related reason before changing Defender settings.
Step 5: Configure Automatic Sample Submission
Next, check Automatic sample submission. When enabled, Microsoft Defender can automatically send certain suspicious samples to Microsoft to help analyze potential threats.
Microsoft lists Automatic sample submission alongside cloud-delivered protection as a recommended security setting.
For a typical Windows PC, leaving this option enabled provides a more complete protection setup. If your computer is managed by an employer or school, however, an administrator may control this setting.
Step 6: Check Tamper Protection
Now look for Tamper Protection in the same settings area. This feature helps prevent malicious applications from changing important Microsoft Defender security settings.
Microsoft explains that tamper protection helps protect settings such as Real-time protection and Cloud-delivered protection from unauthorized changes. When tamper protection is enabled, other applications cannot simply change these protected settings.
For most users, keeping Tamper Protection turned on is a sensible configuration. If you are following instructions that require changing Defender settings and Windows refuses to apply them, tamper protection may be one reason the change is not taking effect.
Step 7: Check Whether Another Antivirus Is Controlling Protection
If Real-time protection is unavailable, greyed out, or does not behave as expected, check whether another antivirus program is installed.
Windows can automatically place Microsoft Defender Antivirus into a disabled state when another antivirus or antimalware product is active. Microsoft says that after the third-party antivirus is uninstalled, Defender should return to active mode automatically.
To check this, open Windows Security, select Virus & threat protection, and look for information about your active security provider. You can also select Manage providers where available to see which antivirus is currently protecting the device.
Avoid intentionally running multiple products that provide competing real-time antivirus protection unless the products specifically support that configuration.
Step 8: Check Group Policy on Managed Windows PCs
If you are using Windows 10 or Windows 11 Pro, Enterprise, or Education, an administrator can configure Microsoft Defender through policy settings.
For example, Microsoft’s documentation identifies the Turn off real-time protection policy under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection. If that policy is configured to turn protection off, it can affect the local setting.
This is particularly important on a work or school computer. If an organization manages the PC, do not change administrative security policies simply to override the organization’s configuration.
Step 9: Verify That Real-Time Protection Is Working
After making your changes, return to Windows Security > Virus & threat protection and review the current protection status.
You can also run a Quick scan from the same page if you want to check the system immediately. Microsoft recommends using a scan when you suspect that malware may be present.
For an individual file or folder, you can right-click the item in File Explorer and select Scan with Microsoft Defender. On Windows 11, you may need to select Show more options before the scanning command appears.
Step 10: Avoid Disabling Real-Time Protection Unless Necessary
It is sometimes necessary to temporarily disable Real-time protection when troubleshooting software or resolving a compatibility issue. However, you should avoid leaving it disabled.
When real-time protection is off, files you open or download are not protected by that specific real-time scanning layer. Microsoft warns that the device can become more vulnerable when Defender is disabled without another active security product.
If you only need to prevent Defender from scanning a particular trusted file or folder, consider using an exclusion instead of disabling the entire antivirus protection. Microsoft specifically identifies exclusions as an alternative when you need to prevent repeated scanning of a particular item.
FAQs
What is Windows Defender Real-Time Protection?
Real-Time Protection is a Microsoft Defender Antivirus feature that continuously monitors your computer for potential threats. It can check files and programs as they are accessed or executed and respond when suspicious activity is detected.
Should Real-Time Protection be turned on?
For normal everyday use, Real-Time Protection should generally remain enabled. Turning it off removes an important layer of active malware protection.
Why can’t I turn on Real-Time Protection?
A different antivirus program may be managing your device, or a Group Policy or other organizational configuration may control Microsoft Defender. Tamper protection can also affect whether certain configuration changes are applied.
Does Real-Time Protection slow down Windows?
Real-time antivirus scanning uses system resources because Windows is checking activity for potential threats. On a modern computer, this is generally part of normal security operation. If you notice unusually high resource usage, investigate the specific process or application rather than permanently disabling antivirus protection.
Does Windows automatically turn Real-Time Protection back on?
Microsoft states that when you temporarily turn off real-time protection, it will turn back on automatically after a short period.
Should Cloud-delivered protection stay enabled?
For most users, yes. Microsoft recommends keeping Cloud-delivered protection and Automatic sample submission enabled for optimal protection.
Can I scan a downloaded file manually?
Yes. In File Explorer, right-click the file and select Scan with Microsoft Defender. Windows 11 may require you to select Show more options first.
Final Words
Configuring Windows Defender Antimalware Real-Time Protection is straightforward once you know where the settings are located. Start with Windows Security, open Virus & threat protection, select Manage settings, and make sure Real-time protection is enabled.
For a normal Windows 10 or Windows 11 PC, a strong everyday configuration is to keep Real-time protection, Cloud-delivered protection, Automatic sample submission, and Tamper protection enabled.
If a setting is greyed out or cannot be changed, check for an active third-party antivirus program or an administrative policy before making further changes.