Windows Defender AV must be configured to run and scan for malware and other potentially unwanted software.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-75153	WNDF-AV-000004	SV-89833r2_rule		High

Description
This policy setting turns off Windows Defender. If you enable this policy setting Windows Defender does not run and computers are not scanned for malware or other potentially unwanted software. If you disable or do not configure this policy setting by default Windows Defender runs and computers are scanned for malware and other potentially unwanted software.

STIG	Date
Windows Defender Antivirus Security Technical Implementation Guide	2017-12-27

Details

Check Text ( C-74945r3_chk )
Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> "Turn off Windows Defender Antivirus" is set to "Disabled" or “Not Configured”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender Criteria: If the value "DisableAntiSpyware" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.

Check Text ( C-74945r3_chk )

Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> "Turn off Windows Defender Antivirus" is set to "Disabled" or “Not Configured”.

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender

Criteria: If the value "DisableAntiSpyware" is REG_DWORD = 0, this is not a finding.

If the value does not exist, this is not a finding.

If the value is 1, this is a finding.

Fix Text (F-81765r2_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> "Turn off Windows Defender Antivirus" to "Disabled" or “Not Configured”.