Increase Cloud Protection Timeout via Regedit

Microsoft Defender Antivirus uses cloud-delivered protection to analyze suspicious files in real time before allowing them to execute. By default, Defender waits up to 10 seconds for a cloud verdict; however, complex files may require additional inspection time. This guide explains how to use the Windows Registry Editor (Regedit) to extend the cloud protection timeout level by up to an additional 50 seconds, allowing for deeper file inspection and stronger security.

Step 1: Open the Registry Editor

Press Windows Key + R to open the Run dialog box.
Type regedit and press Enter (or click OK).
Select Yes if prompted by User Account Control (UAC).

Step 2: Navigate to the Windows Defender Key

In the Registry Editor address bar, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

Step 3: Create the MpEngine Subkey (If Missing)

Check if a folder named MpEngine exists under the Windows Defender key.
If it does not exist:
- Right-click the Windows Defender folder.
- Select New > Key.
- Name the new key MpEngine.

Step 4: Configure the Extended Timeout Value

Click on the MpEngine folder in the left pane.
Right-click anywhere in the empty area of the right pane and select New > DWORD (32-bit) Value.
Name the new value:
```
MpBafsExtendedTimeout
```
Double-click MpBafsExtendedTimeout to edit it.
Under Base, select the Decimal radio button.
In the Value data field, enter the additional time in seconds you want Defender to wait:
- Value range: 0 to 50 (e.g., entering 50 grants a total inspection window of 60 seconds when combined with the default 10-second window).
Click OK to save the changes.

Step 5: Apply the Changes

Close the Registry Editor. Restart your computer or restart the Microsoft Defender Antivirus Service to apply the new timeout settings. Defender will now allow the extended duration for deep file inspection whenever suspicious files are encountered.