Windows Defender Cloud Protection Timeout Registry Key

This article explains how to locate and configure the Windows Defender Cloud-delivered protection timeout settings using the Windows Registry Editor. By adjusting this specific registry value, administrators can extend the amount of time Microsoft Defender Antivirus waits for a cloud response before allowing or blocking a suspicious file.

The Registry Key and Value

The behavior of the Windows Defender Cloud-delivered protection timeout is managed by the MpBafsExtendedTimeout DWORD value located within the MpEngine policy key.

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine
• Value Name: MpBafsExtendedTimeout
• Value Type: REG_DWORD (32-bit)

How the Timeout Works

By default, Microsoft Defender Antivirus blocks a suspicious file for up to 10 seconds while querying the cloud protection service.

• The MpBafsExtendedTimeout value defines additional time in seconds.
• The valid range for this value is 0 to 50 seconds.
• The total cloud check timeout equals the base 10 seconds plus the defined extended value, resulting in a maximum total timeout of 60 seconds.

Steps to Configure the Timeout in Regedit

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

3. Check if the MpEngine subkey exists under Windows Defender. If it does not exist, right-click Windows Defender, select New > Key, and name it MpEngine.

4. Select the MpEngine key.

5. In the right pane, right-click an empty area, select New > DWORD (32-bit) Value, and name it MpBafsExtendedTimeout.

6. Double-click MpBafsExtendedTimeout, set the Base to Decimal, and enter a number between 1 and 50 (representing extra seconds).

7. Click OK and restart the system or the Defender Antivirus service to apply the changes.