Jump to content

How to pause Real-Time Protection?

Go to solution Solved by AlexLeadingEdge,

Recommended Posts

Hi guys,

We asked Malwarebytes Support how to temporarily disable Malwarebytes while we do server upgrades but they came back with this long-winded multi-step answer (below).

Can I make a request for a simple button / Action that allows us to pause the Real-Time Protection for 15-60 minutes?

Incident Response for Endpoint Protection
Incident Response is a component of Endpoint Protection with all the real-time protection layers disabled.
This can be utilized when RTP is not required but you would still like to run threat scans.

  1. Login to your cloud console, and navigate to Settings>Policies then click the "New" button in the upper-right.
  2. Name the policy "Incident Response - RTP disabled" to distinguish this policy from others.
  3. Navigate into Windows>Settings, then disable all switches under the category "Real-Time Protection"
  4. Save the policy. Now navigate to Settings>Groups, then click "New".
  5. Name the group "Troubleshooting" and select the newly created policy for this group.
  6. To move a machine into this group, please navigate to Manage Endpoints then select the move option and select the newly created group.
  7. From the machine itself, restart the service "Malwarebytes Endpoint Agent" to force an immediate policy/group change.
  8. Now, move the endpoint back into its original policy and the "Malwarebytes Service" gets re-added to services.msc and is started.
Link to post
Share on other sites

  • Staff


You should be able to quickly create and deploy an alternate policy (or modify your existing one if you wish to disable protection for all endpoints at once) as documented on page 25 of the administration guide located here.  Once you are done you should be able to switch your clients back to their previous/default policy.  I am not certain whether you will need to restart the clients or the Malwarebytes endpoint software for the new policy settings to take effect, so please keep that in mind if protection doesn't toggle off once you push out the alternate policy.

I hope this helps, but please let us know if you run into any issues and we'll do our best to help.


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.