The Turn off Real-Time Monitoring machine setting should be configured correctly. Turns off Real-Time Protection prompts for known malware detection. Windows Defender alerts you when spyware or potentially unwanted software attempts to install itself or to run on your computer. If you enable this policy setting, Windows Defender will not prompt users to take actions on malware detections. If you disable or do not configure this policy setting, Windows Defender will prompt users to take actions on malware detections. Fix: (1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Defender\Turn off Real-Time Monitoring (2) KEY: HKLM\Software\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring