Configure Microsoft Defender Antivirus with Group Policy

Configure Microsoft Defender Antivirus using Group Policy

In general, you can use the following procedure to configure or change some settings for Microsoft Defender Antivirus.

On your Group Policy management machine, open the Group Policy Management Console , right-click the Group Policy Object (GPO) you want to configure and click Edit .

Using the Group Policy Management Editor go to Computer configuration .

Click Administrative templates .

Expand the tree to Windows components > Microsoft Defender Antivirus .

Expand the section (referred to as Location in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes.

Deploy the updated GPO as you normally do .

Group Policy settings and resources

The following table lists commonly used Group Policy settings that are available in Windows 10.

For the most current settings, see get the latest ADMX files in your central store to access the correct policy options. See How to create and manage the Central Store for Group Policy Administrative Templates in Windows and download the latest files.

Also see Defender/AllowScriptScanning .

Scan removable drives Configure scanning options in Microsoft Defender Antivirus Specify the maximum depth to scan archive files Configure scanning options in Microsoft Defender Antivirus Specify the maximum percentage of CPU utilization during a scan Configure scanning options in Microsoft Defender Antivirus Specify the maximum size of archive files to be scanned Configure scanning options in Microsoft Defender Antivirus Specify the day of the week to run a scheduled scan Configure scheduled scans for Microsoft Defender Antivirus Specify the interval to run quick scans per day Configure scheduled scans for Microsoft Defender Antivirus Specify the scan type to use for a scheduled scan Configure scheduled scans for Microsoft Defender Antivirus Specify the time for a daily quick scan Configure scheduled scans for Microsoft Defender Antivirus Specify the time of day to run a scheduled scan Configure scheduled scans for Microsoft Defender Antivirus Start the scheduled scan only when computer is on but not in use Configure scheduled scans for Microsoft Defender Antivirus Security intelligence updates Allow security intelligence updates from Microsoft Update Manage updates for mobile devices and virtual machines (VMs) Security intelligence updates Allow security intelligence updates when running on battery power Manage updates for mobile devices and virtual machines (VMs) Security intelligence updates Allow notifications to disable definitions-based reports to Microsoft MAPS Manage event-based forced updates Security intelligence updates Allow real-time security intelligence updates based on reports to Microsoft MAPS Manage event-based forced updates Security intelligence updates Check for the latest virus and spyware definitions on startup Manage event-based forced updates Security intelligence updates Define file shares for downloading security intelligence updates Manage Microsoft Defender Antivirus protection and security intelligence updates Security intelligence updates Define the number of days after which a catch up security intelligence update is required Manage updates for endpoints that are out of date Security intelligence updates Define the number of days before spyware definitions are considered out of date Manage updates for endpoints that are out of date Security intelligence updates Define the number of days before virus definitions are considered out of date Manage updates for endpoints that are out of date Security intelligence updates Define the order of sources for downloading security intelligence updates Manage Microsoft Defender Antivirus protection and security intelligence updates Security intelligence updates Initiate security intelligence update on startup Manage event-based forced updates Security intelligence updates Specify the day of the week to check for security intelligence updates Manage when protection updates should be downloaded and applied Security intelligence updates Specify the interval to check for security intelligence updates Manage when protection updates should be downloaded and applied Security intelligence updates Specify the time to check for security intelligence updates Manage when protection updates should be downloaded and applied Security intelligence updates Turn on scan after Security intelligence update Configure scheduled scans for Microsoft Defender Antivirus Threats Specify threat alert levels at which default action should not be taken when detected Configure remediation for Microsoft Defender Antivirus scans Threats Specify threats upon which default action should not be taken when detected Configure remediation for Microsoft Defender Antivirus scans

If you're looking for Antivirus related information for other platforms, see:

Set preferences for Microsoft Defender for Endpoint on macOS

Microsoft Defender for Endpoint on Mac

macOS Antivirus policy settings for Microsoft Defender Antivirus for Intune

Set preferences for Microsoft Defender for Endpoint on Linux

Microsoft Defender for Endpoint on Linux

Configure Defender for Endpoint on Android features

Configure Microsoft Defender for Endpoint on iOS features

Performance tip Due to a variety of factors (examples listed below) Microsoft Defender Antivirus, like other antivirus software, can cause performance issues on endpoint devices. In some cases, you might need to tune the performance of Microsoft Defender Antivirus to alleviate those performance issues. Microsoft's Performance analyzer is a PowerShell command-line tool that helps determine which files, file paths, processes, and file extensions might be causing performance issues; some examples are:

Top paths that impact scan time

Top files that impact scan time

Top processes that impact scan time

Top file extensions that impact scan time

Combinations – for example:

top files per extension

top paths per extension

top processes per path

top scans per file

top scans per file per process

You can use the information gathered using Performance analyzer to better assess performance issues and apply remediation actions. See: Performance analyzer for Microsoft Defender Antivirus .

Configure Microsoft Defender Antivirus using Group Policy

Group Policy settings and resources

See also