Detections
Analytics
WNDF-AV-000023 - Windows Defender AV must be configured to process scanning when real-time protection is enabled.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting a process scan will be initiated when real-time protection is turned on. If you disable this setting a process scan will not be initiated when real-time protection is turned on.Solution
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> Turn on process scanning whenever real-time protection is enabled to 'Enabled' or 'Not Configured'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Defender_Antivirus_V1R9_STIG.zip
Item Details
Audit Name: DISA STIG Windows Defender Antivirus v1r9
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-3, CAT|II, CCI|CCI-001242, Rule-ID|SV-89911r2_rule, STIG-ID|WNDF-AV-000023, Vuln-ID|V-75231
Plugin: Windows
Control ID: e378eeeda2f1fa96aeda1e6e229908ece784613412a005b2b7600a7549292b79