Tamper Protection: Protect Microsoft Defender from being disabled

Tamper Protection is the Microsoft Defender feature that prevents the antivirus from being disabled or changed without authorization, even by a local administrator. It is enabled centrally via Intune or the Microsoft Defender portal, and it is one of the most effective safeguards against ransomware that tries to neutralize Defender.

Disabling antivirus is indeed one of the first actions performed by malware and ransomware during a compromise. In a modern Windows environment, Tamper Protection plays a key role by preventing any unauthorized changes to Microsoft Defender settings.

This article is intended for CIOs, CISOs, and IT teams, detailing the functionality, activation, monitoring, and best practices around Tamper Protection.

What is Tamper Protection in Microsoft Defender?

Tamper Protection is a security feature built into Microsoft Defender designed to block any attempts to modify critical protection settings.

Once enabled on Windows, it notably ensures that:

• real-time protection remains on
• behavior monitoring remains on
• cloud protection remains on
• security intelligence updates keep being applied
• automatic actions are taken on detected threats
• organization-managed exclusions cannot be added or modified (under certain conditions)
• changes to Defender settings through the registry are blocked

Tamper Protection blocks these changes even if attempted via PowerShell, the registry, Group Policy, or with a local administrator account. A Group Policy change may appear to succeed, but it is not applied.

This protection is essential against modern threats that systematically try to neutralize the antivirus before launching an attack.

Why is Tamper Protection Critical for Organizations?

From a security perspective:

• it limits living-off-the-land attacks that rely on built-in tools to disable protection
• it reduces the impact of administrator account compromises
• it stops ransomware from disabling Defender before encryption

From an IT governance perspective:

• it ensures the integrity of security configuration
• it prevents uncontrolled local workarounds
• it strengthens the Zero Trust posture on endpoints

How Do You Enable Tamper Protection Across the Organization?

Tamper Protection is on by default for new deployments, as part of Defender for Endpoint built-in protection. To manage it explicitly, several methods are available. For Intune and the Defender portal, devices must be onboarded to Microsoft Defender for Endpoint.

Via the Microsoft Defender portal

1. Sign in to the Microsoft Defender portal (security.microsoft.com)
2. Navigate to Settings > Endpoints > Advanced features
3. Locate Tamper Protection
4. Enable the feature
5. Save the configuration

Via Microsoft Intune (recommended if you use Intune)

1. Open the Microsoft Intune admin center (intune.microsoft.com)
2. Go to Endpoint security > Antivirus and create a policy
3. Platform Windows, profile Windows Security Experience
4. Set Tamper protection (device) to On
5. Assign the policy to the target groups

Note: an Intune policy takes precedence over the Defender portal setting, which itself takes precedence over the local Windows Security app setting. Configuration Manager devices can be covered through tenant attach, with a Windows (ConfigMgr) Antivirus policy.

Once enabled centrally, Tamper Protection can no longer be disabled locally.

How Do You Check Tamper Protection Status with PowerShell?

Although activation is centralized, you can check the status locally:

Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled

Interpretation

• True → Tamper Protection enabled
• False → Tamper Protection disabled

It is impossible to change this state via PowerShell during normal operation: only troubleshooting mode allows it.

How Do You Temporarily Disable Tamper Protection?

In specific scenarios (advanced troubleshooting, deployment of sensitive software, security investigations), temporarily disabling Tamper Protection may be necessary.

This operation goes through troubleshooting mode in Microsoft Defender for Endpoint.

Procedure to Enable Troubleshooting Mode

1. Sign in to the Microsoft Defender portal (security.microsoft.com)
2. Go to the Devices inventory
3. Select the target device
4. Click Turn on troubleshooting mode
5. Duration: 4 hours maximum

During this window, a local administrator can change protected settings, for example:

Set-MpPreference -DisableTamperProtection $true

At the end of this period, settings automatically revert to their managed state.

This mode should be used exceptionally and under supervision, as it temporarily reduces the endpoint’s protection level.

How Do You Detect Deactivation Attempts?

Windows Logging

Attempts blocked by Tamper Protection are logged in the Windows Event Viewer.

• Event ID: 5013 (Tamper Protection blocked a change to Microsoft Defender Antivirus)
• Event ID: 5007 (Microsoft Defender Antivirus configuration changed, useful for auditing)
• Path: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

Monitoring via Microsoft Defender for Endpoint and Microsoft Sentinel

In environments using Microsoft Defender for Endpoint (MDE), tampering attempts surface in the Microsoft Defender portal (alerts, device timeline) and in advanced hunting:

DeviceEvents
| where Timestamp > ago(10d)
| where ActionType == "TamperingAttempt"

This data can then be leveraged in Microsoft Sentinel (via the Microsoft Defender XDR connector) to:

• detect targeted compromise attempts
• correlate with high-privilege events
• enrich SOC detection rules

SOC / CISO Best Practices

• enable alerts on tampering events
• monitor repeated attempts on the same endpoint
• correlate with privilege escalation attempts

Conclusion

Tamper Protection is an essential component of Windows endpoint security. It prevents any attempt to neutralize Microsoft Defender, whether intentional or malicious.

For CIOs, CISOs, and security teams, enabling it ensures the integrity of antivirus configuration and strengthens defense posture against advanced threats.

Want to deepen your knowledge of Microsoft Defender, Intune, or Microsoft Sentinel security? Check out my other articles or contact me to discuss your security challenges.