Hello.. please don't say there is no way to disable this via registry..
Found:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features <TamperProtection>
But cannot set it to 0 to disable
Also could NOT set the ownership!
However, even if I can set that key, it just turns it off, will not disable it,
I want to disable it or set it gray so cannot change at all, must be another key?
Hello @Kishvand,
I'm afraid this is a protected DWORD value for security purposes, and Windows will not let you easily change it manually without changing permissions.
If you are the only administrator on the computer, you can set it to what you want in Windows Security, and standard user accounts will not be able to change it.
Last edited by Brink; 27 Aug 2019 at 14:51. Reason: addition
You can modify protected values by first changing the permissions on the parent key. Right click on the key and click permissions then click advanced and change ownership (including subcontainers and objects) to your login (or all administrators). You will then be able to give yourself (or all administrators) full control and be able to make the desired changes.
Just to note that changing the owner and/or permissions of this registry key will cause a security risk since it will now be able to be changed which nullifies the purpose of tamper protection of only change from withing Windows Security.
Brink, you are absolutely right. I should have included instructions to change the permissions back to their original state and then change the owner back (SYSTEM in this case). It should also be stressed that it is possible that merely changing the value of certain parameters may result in reduced security even if the permissions are returned to their original values.
Thanks for this post, Brink. It took until almost October for me to finally get 1903 installed. I found out about Tamper Protection 24 hours later. Sure would have been nice if Microsoft would tell people who were using Windows Defender before the “1903 Upgrade” that they had decided to turn it off.If Microsoft recommends enabling Tamper Protection, why is it not enabled by default?
It is enabled by default according to https://support.microsoft.com/en-us/...per-protection
However, I suspect it does not work without UAC enabled. A few days ago, when my UAC was disabled, my protection was disabled by malware although Tamper Protection was enabled. See: Why did Windows Defenders fail to stop the threats from running?
At May 2020, HP users are having a real BSOD KMODE problem with bootloop, possibly caused by interaction between drivers and Windows Defender.
To cut a long story short, I disabled Tamper Protection via Windows Security UI, prior to squashing almost all of Defender through regedit. On looking at the registry entry for Tamper Protection, the Dword value is set to 4, and not 0 as expected. I know that 4 is "Disabled" for services entries, but is this also the case for the Tamper Protection entry. If not, what does it mean?
Screenshot included.
Quote
