Turn On or Off Real-time Protection for Microsoft Defender Antivirus  

I'm currently checking out the Group Policy edit. It looks fairly straight forward, so after I've done my next daily OS image backup I'm going to give it a go.

I will post back how I got on

Group policy change in 1809 showed real time protection grayed out and off in settings saying its controlled by gp.

Now in 21h2 settings its not and will automatically turn ON after reboot?

I just use virustotal if I download anything shady and to avoid it quarantining unnecessarily.

So the difference was that tamper protection was implemented sometime between those releases and now works the same with a simple switch off in settings.

Actually got the answer from you on microsoft forums when did a little searching linking to elevenforums but didnt have time to test it :)

Thanks.

With every Windows update, it becomes harder and harder to disable RTP for good. So I came up with a solution with a friend, everything is explained in the README file: GitHub - duttyend/Microsoft-Defender-RTP-stop: Windows Task to disable Microsoft Defender Real-time protection automatically and survive restart, updates, scans, etc.

It's just a task to import in task manager and it executes a PowerShell command based on triggers.