$Key = "LocalSettingOverrideDisableRealtimeMonitoring"
$PolicyRegKey = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection").$Key

If ($PolicyRegKey -eq 1) {
    $CheckResult = "Enabled"
} ElseIf ($PolicyRegKey -eq 0) {
    $CheckResult = "Disabled"
} Else {
    $CheckResult = "Not Configured"
}

$ButtonType = [System.Windows.MessageBoxButton]::YesNoCancel
$MessageboxTitle = “Real-Time Protection policy switch”
$Messageboxbody = “Current policy setting is: $CheckResult `n `n Press 'YES' to Enable policy `n Press 'NO' to Disable policy `n Press 'CANCEL' to exit”
$MessageIcon = [System.Windows.MessageBoxImage]::Warning
$MessageReturn = [System.Windows.MessageBox]::Show($Messageboxbody,$MessageboxTitle,$ButtonType,$messageicon)



If ($MessageReturn -eq "Yes") {
    $PolValue = 1
} ElseIf ($MessageReturn -eq "No") {
    $PolValue = 0
} ElseIf ($MessageReturn -eq "Cancel") {
    Break
}

If ($CheckResult -eq "Not Configured") {
    New-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name $Key -PropertyType dword -Value $PolValue
}

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name $Key -Value $PolValue