Windows 10 22H2 · 1.0

This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware [removed: definitions are][added: security intelligence is] disabled. It is recommended that this setting remain disabled. If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware [removed: definitions are][added: security intelligence is] disabled. If you disable or do not configure this setting, the antimalware service will be stopped when both antivirus and antispyware [removed: definitions are][added: security intelligence is] disabled. If the computer is restarted, the service will be started if it is set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware [removed: definitions are][added: security intelligence is] enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped.

This policy setting allows you to define the number of days that must pass before spyware [removed: definitions are][added: security intelligence is] considered out of date. If [removed: definitions are][added: security intelligence is] determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. If you enable this setting, spyware [removed: definitions][added: security intelligence] will be considered out of date after the number of days specified have passed without an update. If you disable or do not configure this setting, spyware [removed: definitions][added: security intelligence] will be considered out of date after the default number of days have passed without an update.

This policy setting allows you to define the number of days that must pass before virus [removed: definitions are][added: security intelligence is] considered out of date. If [removed: definitions are][added: security intelligence is] determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. If you enable this setting, virus [removed: definitions][added: security intelligence] will be considered out of date after the number of days specified have passed without an update. If you disable or do not configure this setting, virus [removed: definitions][added: security intelligence] will be considered out of date after the default number of days have passed without an update.

This policy setting allows you to configure UNC file share sources for downloading [removed: definition][added: security intelligence] updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the [removed: definition][added: security intelligence] update sources. For example: "{\\unc1 | \\unc2 }". The list is empty by default. If you enable this setting, the specified sources will be contacted for [removed: definition][added: security intelligence] updates. Once [removed: definition][added: security intelligence] updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted.

This policy setting allows you to configure the automatic scan which starts after a [removed: definition][added: security intelligence] update has occurred. If you enable or do not configure this setting, a scan will start following a [removed: definition][added: security intelligence] update. If you disable this setting, a scan will not start following a [removed: definition][added: security intelligence] update.

This policy setting allows you to configure [removed: definition][added: security intelligence] updates when the computer is running on battery power. If you enable or do not configure this setting, [removed: definition][added: security intelligence] updates will occur as usual regardless of power state. If you disable this setting, [removed: definition][added: security intelligence] updates will be turned off while the computer is running on battery power.

This policy setting allows you to configure [removed: definition][added: security intelligence] updates on startup when there is no antimalware engine present. If you enable or do not configure this setting, [removed: definition][added: security intelligence] updates will be initiated on startup when there is no antimalware engine present. If you disable this setting, [removed: definition][added: security intelligence] updates will not be initiated on startup when there is no antimalware engine present.

This policy setting allows you to define the order in which different [removed: definition][added: security intelligence] update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the [removed: definition][added: security intelligence] update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares” For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } If you enable this setting, [removed: definition][added: security intelligence] update sources will be contacted in the order specified. Once [removed: definition][added: security intelligence] updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. If you disable or do not configure this setting, [removed: definition][added: security intelligence] update sources will be contacted in a default order.

This policy setting allows you to enable download of [removed: definition][added: security intelligence] updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update. If you enable this setting, [removed: definition][added: security intelligence] updates will be downloaded from Microsoft Update. If you disable or do not configure this setting, [removed: definition][added: security intelligence] updates will be downloaded from the configured download source.

This policy setting allows you to enable real-time [removed: definition][added: security intelligence] updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest [removed: definition][added: security intelligence] update has [removed: definitions][added: security intelligence] for a threat involving that file, the service will receive all of the latest [removed: definitions][added: security intelligence] for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work. If you enable or do not configure this setting, real-time [removed: definition][added: security intelligence] updates will be enabled. If you disable this setting, real-time [removed: definition][added: security intelligence] updates will disabled.

This policy setting allows you to specify the day of the week on which to check for [removed: definition][added: security intelligence] updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never If you enable this setting, the check for [removed: definition][added: security intelligence] updates will occur at the frequency specified. If you disable or do not configure this setting, the check for [removed: definition][added: security intelligence] updates will occur at a default frequency.

This policy setting allows you to specify the time of day at which to check for [removed: definition][added: security intelligence] updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for [removed: definition][added: security intelligence] updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. If you enable this setting, the check for [removed: definition][added: security intelligence] updates will occur at the time of day specified. If you disable or do not configure this setting, the check for [removed: definition][added: security intelligence] updates will occur at the default time.

This policy setting allows you to configure the antimalware service to receive notifications to disable individual [removed: definitions][added: security intelligence] in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable [removed: definitions][added: security intelligence] that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work. If you enable this setting or do not configure, the antimalware service will receive notifications to disable [removed: definitions.][added: security intelligence.] If you disable this setting, the antimalware service will not receive notifications to disable [removed: definitions.][added: security intelligence.]

This policy setting allows you to define the number of days after which a catch-up [removed: definition][added: security intelligence] update will be required. By default, the value of this setting is 1 day. If you enable this setting, a catch-up [removed: definition][added: security intelligence] update will occur after the specified number of days. If you disable or do not configure this setting, a catch-up [removed: definition][added: security intelligence] update will be required after the default number of days.

This policy setting allows you to specify an interval at which to check for [removed: definition][added: security intelligence] updates. The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day). If you enable this setting, checks for [removed: definition][added: security intelligence] updates will occur at the interval specified. If you disable or do not configure this setting, checks for [removed: definition][added: security intelligence] updates will occur at the default interval.

This policy setting allows you to manage whether a check for new virus and spyware [removed: definitions][added: security intelligence] will occur immediately after service startup. If you enable this setting, a check for new [removed: definitions][added: security intelligence] will occur after service startup. If you disable this setting or do not configure this setting, a check for new [removed: definitions][added: security intelligence] will not occur after service startup.

This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new [removed: definitions][added: security intelligence] and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. If you enable this setting, you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting, you will not join Microsoft MAPS. In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership.