Turn On or Off Tamper Protection for Microsoft Defender Antivirus

Heimataerde · 26 Aug 2020

RickC said:

A late reply, I know, but from my own tests (changing the states of Defender components and refreshing the registry) it looks like a DWORD value of 4 indicates both Tamper Protection and Cloud-delivered protection have been set to OFF:

Attachment 294695

Hope this helps...

I can also verify this.

Has anyone found a way to alter this registry value? Possibly from the outside using chntpw and linux? I can't test this right now...

Brink · 01 Sep 2020

Microsoft Defender Antivirus tamper protection is turned on by default for all consumer Windows 10 devices. This feature protects devices from cyber attacks that try to disable built-security solutions, such as antivirus protection, in an attempt to gain access to your data, to install malware, or to otherwise exploit your data, identity, and devices. As Microsoft Defender antivirus automatically turns itself off when it detects another antivirus program, we are removing a legacy registry setting called DisableAntiSpyware. Intended to be used by OEMs and IT admins to disable Microsoft Defender Antivirus for the purpose of deploying another antivirus product during deployment, DisableAntiSpyware is not applicable to consumer devices and will be removed beginning with Microsoft Defender Antimalware platform versions 4.18.2007.8 and higher (see KB4052623 for details). This update will be rolled out to devices running Windows Enterprise E3 and E5 at a future date.

Source: https://docs.microsoft.com/en-us/win...age-center#465

Heimataerde · 10 Oct 2020

Brink said:

Source: https://docs.microsoft.com/en-us/win...age-center#465

There has to be some way to disable this, possibly from outside of Windows. Has anyone looked into this further?

Brink · 11 Oct 2020

Heimataerde said:

There has to be some way to disable this, possibly from outside of Windows. Has anyone looked into this further?

Unfortunately, for security purposes, it's been hard coded to only be able to successfully keep Tamper Protection turned on/off via the Windows Security app.

This way malware will not be able to disable it.

dhon joe · 15 May 2021

to take ownership of protected keys, go into SAFE MODE and then you can take ownership and set permissions to any key no matter how protected it is

Kishvand said:

Hello.. please don't say there is no way to disable this via registry..
Found:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features <TamperProtection>
But cannot set it to 0 to disable
Also could NOT set the ownership!
However, even if I can set that key, it just turns it off, will not disable it,
I want to disable it or set it gray so cannot change at all, must be another key?

- - - Updated - - -

Heimataerde said:

I can also verify this.

Has anyone found a way to alter this registry value? Possibly from the outside using chntpw and linux? I can't test this right now...

you can alter this registry value by FIRST going into SAFE MODE and taking ownership of the Features tree and giving yourself full control permissions.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features

dhon joe · 26 May 2021

and then delete it

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features

wellyj · 24 Jun 2022

Tamper protection is greyed out for me:

Turn On or Off Tamper Protection for Microsoft Defender Antivirus-tp.png

I've looked through gpedit and saw no mention of it and don't remember changing it either..

I do have MDAG enabled.
Does that reinforce Tamper protection?

Anixx · 15 Mar 2024

Brink said:

Hello @Kishvand,

I'm afraid this is a protected DWORD value for security purposes, and Windows will not let you easily change it manually without changing permissions.

If you are the only administrator on the computer, you can set it to what you want in Windows Security, and standard user accounts will not be able to change it.

What to do if I cannot start the Windows Security GUI?

Brink · 15 Mar 2024

Anixx said:

What to do if I cannot start the Windows Security GUI?

Hello,.

From our conversation below:

Reset Windows Security app in Windows 11 Tutorial | Page 2 | Windows 11 Forum

Anixx · 15 Mar 2024

Brink said:

Hello,.

From our conversation below:

Reset Windows Security app in Windows 11 Tutorial | Page 2 | Windows 11 Forum

Well, actually the posts above provided information on how I can disable temper limitatios using safe mode, which I actually did and uninstalled the defender service.
I note though: deleting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features as advised above is impossible even in safe mode and even after taling ownership over it. Still, changing the value of the temper service is possible.