🟠 High   ⏱ 5–30 min  Last verified: 18 May 2026
Affected versions: Windows Server 2022

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Quick Checks
  3. Deep Diagnosis
  4. Primary Fix
  5. Verification
  6. Prevention & Hardening

Symptom & Impact

Real-time protection remains off despite endpoint protection requirements, often after conflicting baseline deployment. Malware exposure increases and security audits fail. EDR visibility becomes incomplete if core AV components are disabled.

Quick Checks

Review Defender health, tamper protection state, and applied policy precedence across local and domain scopes.

Get-MpComputerStatus
Get-MpPreference
gpresult /h C:Tempdefender-gp.html

Deep Diagnosis

Inspect Security-Mitigations and Defender operational logs for policy source and enforcement errors.

Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 150
Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindows Defender'
Get-CimInstance -Namespace rootMicrosoftWindowsDefender -ClassName MSFT_MpComputerStatus

Primary Fix

Remove conflicting disable keys, re-enable Defender components, and force policy refresh from authoritative source.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

Remove-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindows Defender' -Name DisableAntiSpyware -ErrorAction SilentlyContinue
Set-MpPreference -DisableRealtimeMonitoring $false
Restart-Service WinDefend
gpupdate /force

Verification

Real-time and behavior monitoring should report enabled with up-to-date signatures.

Get-MpComputerStatus | Select AMRunningMode,RealTimeProtectionEnabled,AntispywareSignatureLastUpdated
Update-MpSignature

Prevention & Hardening

Consolidate AV policy ownership and monitor drift for disable flags via compliance scripts.

Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindows Defender'
Get-MpPreference | Select DisableRealtimeMonitoring,DisableIOAVProtection

Illustrative mockup for windows-server-2022 — terminal_or_powershell
Diagnostics commands in PowerShell — Illustrative mockup — Progressive Robot
Illustrative mockup for windows-server-2022 — event_or_log_viewer
Event log verification for Windows Server 2022 — Illustrative mockup — Progressive Robot

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.