Turn on raw volume write notifications

This policy setting controls whether raw volume write notifications are sent to behavior monitoring.

If you enable or do not configure this setting, raw write notifications will be enabled.

If you disable this setting, raw write notifications be disabled.

Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSoftware\Policies\Microsoft\Windows Defender\Real-Time Protection
Value NameDisableRawWriteNotification
Value TypeREG_DWORD
Enabled Value0
Disabled Value1

windowsdefender.admx

Administrative Templates (Computers)

Administrative Templates (Users)