Windows Defender AV must be configured to process scanning when real-time protection is enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213447	WNDF-AV-000023	SV-213447r569189_rule		Medium

Description
This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting a process scan will be initiated when real-time protection is turned on. If you disable this setting a process scan will not be initiated when real-time protection is turned on.

Description

This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting a process scan will be initiated when real-time protection is turned on. If you disable this setting a process scan will not be initiated when real-time protection is turned on.

STIG	Date
Microsoft Windows Defender Antivirus Security Technical Implementation Guide	2021-09-30

Details

Check Text ( C-14672r314650_chk )
Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn on process scanning whenever real-time protection is enabled" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableScanOnRealtimeEnable" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.

Check Text ( C-14672r314650_chk )

Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn on process scanning whenever real-time protection is enabled" is set to "Enabled" or "Not Configured".

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection

Criteria: If the value "DisableScanOnRealtimeEnable" is REG_DWORD = 0, this is not a finding.

If the value does not exist, this is not a finding.

If the value is 1, this is a finding.

Fix Text (F-14670r314651_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> Turn on process scanning whenever real-time protection is enabled to "Enabled" or "Not Configured".