This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on. If you disable this setting, a process scan will not be initiated when real-time protection is turned on. Counter Measure: Configure this setting depending on your organizations requirements. Potential Impact: Process scanning can impact performance. Fix: (1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows Defender\Real-time Protection\Turn on process scanning whenever real-time protection is enabled (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection!DisableScanOnRealtimeEnable