Turn on raw volume write notifications

Supported on: At least Windows Server 2012, Windows 8 or Windows RT

Registry

HKLM Software\Policies\Microsoft\Windows Defender\Real-Time Protection

Value name: DisableRawWriteNotification

Enabled: DisableRawWriteNotification = 0

Disabled: DisableRawWriteNotification = 1

Description

This policy setting controls whether raw volume write notifications are sent to behavior monitoring. If you enable or do not configure this setting, raw write notifications will be enabled. If you disable this setting, raw write notifications be disabled.