Tamper protection managed by administrator - greyed

colsearle · 12 Jan 2022

Greetings all

I have 2 desktop's and a laptop all on 21H2 local accounts apart from apps being allowed to sign into my MS account.

My laptop is dual booting 10 and 11. i am a home user in no way linked to any domains or work / school accounts. There is no other security on my computers.

On all of my machines tamper protection is greyed and the setting is marked managed by your administrator.

On one of my desktops I have changed the Tamper reg 5 to 0 which does turn it off however it is still greyed and marked managed by administrator. i have also tried removing WD permissions.

All machines behaving the same way... Can somebody shed some light ?

Pejole2165 · 12 Jan 2022

Well to start with, the tamper protection registry key is supposed to be protected in a way that prevents malware from circumventing it, including trying to change permissions on the key to change it. I have a feeling all you have done is disable the ability to change the setting for a normal/ admin user, rather than disable tamper protection. How exactly did you change the reg key?

colsearle · 12 Jan 2022

I booted from a 10 flash drive opened cmd ran regedit and loaded the hive to change the value.

Thanks for reading

Pejole2165 · 12 Jan 2022

Ok, so what is the issue? Do all your machines show the same greyed out setting even though you only changed it on one machine, and you are asking why?
Or are you asking how to reverse your changes?
If the first question then it is possible if you have syncing enabled that the setting value will propagate to all synced machines, which seems wrong and a major oversight on Microsoft's part, if true, but stranger things have happened.
I think what happens when you boot from a Windows USB setup disk is you are automatically assigned as administrator.
For question two, do what you did to change the setting, but reverse your changes.

colsearle · 12 Jan 2022

My concern is that tamper protection should be switchable on off within Defender and not be marked as managed by an administrator and greyed. I am not asking how to reverse the changes I have made to the one PC where i changed the registry value.

There are times when i wish to disable Defender Realtime protection which is not possible with tamper protection turned on.

As I don't sign into of my machines I cannot imagine the setting is synced at all.