# Tamper Protection: Protect Microsoft Defender from being disabled

> What Microsoft Defender Tamper Protection blocks, how to turn it on with Intune or the Defender portal, and how to check it is enforced on every device.

- URL: https://benjamintestart.fr/en/tamper-protection-protect-microsoft-defender-from-being-disabled/
- Author: Benjamin Testart (Devices Practice Leader & Microsoft Intune consultant)
- Published: 2026-01-16
- Updated: 2026-10-05
- Category: Security & Defender
- Language: en
- Tags: Defender for Endpoint, Microsoft Defender Antivirus, Intune, Microsoft Sentinel, PowerShell
- Version française: https://benjamintestart.fr/fr/tamper-protection-proteger-microsoft-defender-contre-toute-desactivation/

## TL;DR

Tamper Protection prevents Microsoft Defender Antivirus critical settings from being disabled or changed, even by a local administrator, through PowerShell, the registry or Group Policy. It is enabled at scale via Intune or the Microsoft Defender portal, checked with Get-MpComputerStatus, and can only be bypassed temporarily through troubleshooting mode.

Tamper Protection is the Microsoft Defender feature that prevents the antivirus from being disabled or changed without authorization, even by a local administrator. It is enabled centrally via Intune or the Microsoft Defender portal, and it is one of the most effective safeguards against ransomware that tries to neutralize Defender.

Disabling antivirus is indeed one of the first actions performed by malware and ransomware during a compromise. In a modern Windows environment, **Tamper Protection** plays a key role by preventing any unauthorized changes to **Microsoft Defender** settings.

This article is intended for **CIOs, CISOs, and IT teams**, detailing the functionality, activation, monitoring, and best practices around Tamper Protection.

## What is Tamper Protection in Microsoft Defender?

**Tamper Protection** is a security feature built into Microsoft Defender designed to block any attempts to modify critical protection settings.

Once enabled on Windows, it notably ensures that:

- real-time protection remains on
- behavior monitoring remains on
- cloud protection remains on
- security intelligence updates keep being applied
- automatic actions are taken on detected threats
- organization-managed exclusions cannot be added or modified (under certain conditions)
- changes to Defender settings through the registry are blocked

Tamper Protection blocks these changes **even if attempted via PowerShell, the registry, Group Policy, or with a local administrator account**. A Group Policy change may appear to succeed, but it is not applied.

This protection is essential against modern threats that systematically try to neutralize the antivirus before launching an attack.

## Why is Tamper Protection Critical for Organizations?

From a security perspective:

- it limits _living-off-the-land_ attacks that rely on built-in tools to disable protection
- it reduces the impact of administrator account compromises
- it stops ransomware from disabling Defender before encryption

From an IT governance perspective:

- it ensures the integrity of security configuration
- it prevents uncontrolled local workarounds
- it strengthens the Zero Trust posture on endpoints

## How Do You Enable Tamper Protection Across the Organization?

Tamper Protection is on by default for new deployments, as part of Defender for Endpoint built-in protection. To manage it explicitly, several methods are available. For Intune and the Defender portal, devices must be onboarded to Microsoft Defender for Endpoint.

### Via the Microsoft Defender portal

1. Sign in to the **Microsoft Defender portal (security.microsoft.com)**
2. Navigate to **Settings > Endpoints > Advanced features**
3. Locate **Tamper Protection**
4. Enable the feature
5. Save the configuration

### Via Microsoft Intune (recommended if you use Intune)

1. Open the **Microsoft Intune admin center (intune.microsoft.com)**
2. Go to **Endpoint security > Antivirus** and create a policy
3. Platform **Windows**, profile **Windows Security Experience**
4. Set **Tamper protection (device)** to **On**
5. Assign the policy to the target groups

Note: an Intune policy takes precedence over the Defender portal setting, which itself takes precedence over the local Windows Security app setting. Configuration Manager devices can be covered through tenant attach, with a Windows (ConfigMgr) Antivirus policy.

Once enabled centrally, Tamper Protection **can no longer be disabled locally**.

## How Do You Check Tamper Protection Status with PowerShell?

Although activation is centralized, you can check the status locally:

```powershell
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled
```

### Interpretation

- `True` → **Tamper Protection enabled**
- `False` → **Tamper Protection disabled**

It is **impossible to change this state via PowerShell** during normal operation: only troubleshooting mode allows it.

## How Do You Temporarily Disable Tamper Protection?

In specific scenarios (advanced troubleshooting, deployment of sensitive software, security investigations), temporarily disabling Tamper Protection may be necessary.

This operation **goes through troubleshooting mode** in Microsoft Defender for Endpoint.

### Procedure to Enable Troubleshooting Mode

1. Sign in to the **Microsoft Defender portal (security.microsoft.com)**
2. Go to the **Devices** inventory
3. Select the target device
4. Click **Turn on troubleshooting mode**
5. Duration: **4 hours** maximum

During this window, a local administrator can change protected settings, for example:

```powershell
Set-MpPreference -DisableTamperProtection $true
```

At the end of this period, **settings automatically revert to their managed state**.

This mode should be used exceptionally and under supervision, as it temporarily reduces the endpoint’s protection level.

## How Do You Detect Deactivation Attempts?

### Windows Logging

Attempts blocked by Tamper Protection are logged in the Windows Event Viewer.

- **Event ID**: `5013` (Tamper Protection blocked a change to Microsoft Defender Antivirus)
- **Event ID**: `5007` (Microsoft Defender Antivirus configuration changed, useful for auditing)
- **Path**: `Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational`

### Monitoring via Microsoft Defender for Endpoint and Microsoft Sentinel

In environments using **Microsoft Defender for Endpoint (MDE)**, tampering attempts surface in the Microsoft Defender portal (alerts, device timeline) and in advanced hunting:

```kusto
DeviceEvents
| where Timestamp > ago(10d)
| where ActionType == "TamperingAttempt"
```

This data can then be leveraged in **Microsoft Sentinel** (via the Microsoft Defender XDR connector) to:

- detect targeted compromise attempts
- correlate with high-privilege events
- enrich SOC detection rules

#### SOC / CISO Best Practices

- enable alerts on tampering events
- monitor repeated attempts on the same endpoint
- correlate with privilege escalation attempts

## Conclusion

Tamper Protection is an essential component of Windows endpoint security. It prevents any attempt to neutralize Microsoft Defender, whether intentional or malicious.

For **CIOs, CISOs, and security teams**, enabling it ensures the integrity of antivirus configuration and strengthens defense posture against advanced threats.

Want to deepen your knowledge of Microsoft Defender, Intune, or Microsoft Sentinel security? Check out my other articles or contact me to discuss your security challenges.

## Key takeaways

- Tamper Protection locks Defender real-time protection, behavior monitoring, cloud protection, updates and exclusions.
- It is managed via Intune (Antivirus policy), the Microsoft Defender portal, Configuration Manager tenant attach or, per device, the Windows Security app.
- An Intune policy takes precedence over the Defender portal setting, which itself takes precedence over the local setting.
- Get-MpComputerStatus (IsTamperProtected property) checks the status on a device.
- Troubleshooting mode allows it to be disabled temporarily, for up to 4 hours.

## Frequently asked questions

### How do I enable Tamper Protection for the whole organization?

In the Microsoft Defender portal (security.microsoft.com), go to Settings > Endpoints > Advanced features and turn on Tamper Protection. With Intune, create an Endpoint security > Antivirus policy, Windows Security Experience profile, and set Tamper protection (device) to On.

### How do I check whether Tamper Protection is enabled on a Windows device?

Run Get-MpComputerStatus | Select-Object IsTamperProtected in PowerShell. A value of True means tamper protection is active.

### Can Tamper Protection be disabled with PowerShell?

Not during normal operation. You must first turn on troubleshooting mode for the device in the Microsoft Defender portal; during those 4 hours, a local administrator can change protected settings.

### Which Windows event shows a change blocked by Tamper Protection?

Event 5013 in the Microsoft-Windows-Windows Defender/Operational log indicates that Tamper Protection blocked a change to Microsoft Defender Antivirus. Event 5007 records configuration changes.

## Sources and documentation

- [Tamper protection overview](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-overview)
- [Configure tamper protection on Windows](https://learn.microsoft.com/en-us/defender-endpoint/tamper-protection-windows-configure)
- [Troubleshooting mode in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/troubleshooting-mode-enable)
- [Microsoft Defender Antivirus event logs and error codes](https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus)