This policy setting controls whether raw volume write notifications are sent to behavior monitoring.If you enable or do not configure this setting raw write notifications will be enabled.If you disable this setting raw write notifications be disabled.
Policy path:
Windows Components\Windows Defender\Real-time Protection
Scope:
Machine
Supported on:
At least Windows Server 2012 Windows 8 or Windows RT
Registry settings:
HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection!DisableRawWriteNotification
Filename:
WindowsDefender.admx