System Center Endpoint Protection: Real-Time Protection

Question

Hello,

I have a collection of machines that I need to know if the Real-Time protection is checked or uncheched (Real-Time Protection will be done by Trellix not SCEP):

2023-10-05_18-16-22 Real-Time Protection checked.jpg

2023-10-05_18-16-22 Real-Time Protection Unchecked.jpg 

I tried a CMPivot on the collection:

Registry('HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection') | where Property == 'LocalSettingOverrideDisableRealTimeMonitoring'

But apparently it is not what I am looking for as two machine with Real-Time Protection Set are showing different results 0 & 1.

2023-10-05_18-09-44 RTP 01.jpg

2023-10-05_18-10-26 RTP Client ON 02.jpg

2023-10-05_18-10-26 RTP Client ON 01.jpg

Also CMPivot is showing 208 clients offline, what does it mean as these machines are servers so all of them are on 24/7.

2023-10-05_18-47-39 CMPivot Client offline.jpg

I saw also "Enable real-time Protection":

2023-10-05_18-15-17 RTP Client NO 01.jpg

2023-10-05_18-28-08 RTP Client YES.jpg

What is the difference between the "Unchecked"/Checked" from the top and the "No/Yes" just above?

Any idea?

Thanks,
Dom

Answer 1

Hi, @Duchemin, Dominique

Thank you for posting in Microsoft Q&A forum.

What is the difference between the "Unchecked"/Checked" from the top and the "No/Yes" just above?

If we "Unchecked" from the top, the users can configure the "Real-time protection" by themselves.

If we "Checked" from the top and set "No" to "Enable real-time protection" and "No" to "Allow users on client computers to configure real-time protection settings", the real-time protection will be disabled by default and the user cannot modify it.

If we "Checked" from the top and set "No" to "Enable real-time protection" and "Yes" to "Allow users on client computers to configure real-time protection settings", the real-time protection will be disabled by default and the user can modify it.

We can use the powershell to get the RealTimeProtection status:

Get-MpComputerStatus | select RealTimeProtectionEnabled

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".

Answer 2

Hi @AllenLiu-MSFT

Thanks for this answer.

What about the other questions:

I have a collection of machines that I need to know if the Real-Time protection is checked or uncheched (Real-Time Protection will be done by Trellix not SCEP):

2023-10-05_18-16-22 Real-Time Protection checked.jpg

2023-10-05_18-16-22 Real-Time Protection Unchecked.jpg 

I tried a CMPivot on the collection:

Registry('HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Real-Time Protection') | where Property == 'LocalSettingOverrideDisableRealTimeMonitoring'

But apparently it is not what I am looking for as two machine with Real-Time Protection Set are showing different results 0 & 1.

2023-10-05_18-09-44 RTP 01.jpg

2023-10-05_18-10-26 RTP Client ON 02.jpg

2023-10-05_18-10-26 RTP Client ON 01.jpg

Also CMPivot is showing 208 clients offline, what does it mean as these machines are servers so all of them are on 24/7.

2023-10-05_18-47-39 CMPivot Client offline.jpg

Thanks,

Dom

Answer 3

Hello @AllenLiu-MSFT

So this means that only the option:

"If we "Checked" from the top and set "No" to "Enable real-time protection" and "No" to "Allow users on client computers to configure real-time protection settings", the real-time protection will be disabled by default and the user cannot modify it."

Will allow the Administrators to control and have the Realtime Protection Disabled, isn't it?

So the Uncheck/Check is just a User access nothing with the RealTimeProtection status.

What are the associated value for checked or unchecked?

What are the associated keys and values in the registries of :

• "No" to "Enable real-time protection"
• "Yes" to "Enable real-time protection"
• "No" to "Allow users on client
• "Yes" to "Allow users on client

What are the associated tables and values in the SQL Views/tables of

• "No" to "Enable real-time protection"
• "Yes" to "Enable real-time protection"
• "No" to "Allow users on client
• "Yes" to "Allow users on client
• Thanks,
  Dom

Answer 4

The issue is marked as resolved in another thread:

https://learn.microsoft.com/en-us/answers/questions/1384620/settings-system-center-endpoint-protection-validat