Defender tamper protection: what it locks and why admins notice

Tamper protection keeps key Microsoft Defender Antivirus settings from being switched off or edited, even by an administrator or a script. If a Group Policy change appears to succeed but nothing actually changes on the device, tamper protection is a likely reason.

Why it exists

Microsoft's overview says attackers often try to disable security features during an attack so they can reach data, install malware and exploit identities and devices. Tamper protection helps protect important security settings from being disabled or changed. Disabling the antivirus is an early step in many intrusions, so locking it is worth doing.

What it locks on Windows

With tamper protection enabled on Windows, these settings cannot be changed:

• Virus and threat protection stays enabled.
• Real-time protection stays on.
• Behavior monitoring stays on.
• Cloud protection stays enabled.
• Security intelligence updates continue.
• Automatic actions are taken on detected threats.
• Archived files are scanned.
• Exclusions cannot be modified or added, subject to the conditions in Microsoft's exclusion protection page.
• Attempts to change Defender settings through the registry are blocked.

It does not stop you from viewing settings. It also continues to protect the Defender service when Defender runs in passive mode next to another security product.

Why admins get confused

Microsoft notes that when tamper protection is on, changes made through a management tool, including Group Policy, might appear to succeed but are blocked by tamper protection. A developer who needs a build to pass, or an admin following an old guide, may edit a policy, see no error, and wonder why nothing changed.

Event ID 5013 can appear when tamper protection blocks a change. The documented way to change a protected setting temporarily is troubleshooting mode, which temporarily disables tamper protection, rather than trying to bypass it.

Where it can be managed

Depending on your setup, tamper protection can be managed from Microsoft Intune, the Microsoft Defender portal, Configuration Manager through tenant attach, or the Windows Security app. Devices need to be onboarded to Defender for Endpoint before you configure it from Intune or the portal, and until then it appears as not applicable.

Microsoft also notes that turning it on, starting with platform update 4.18.2111.5, automatically turns on cloud delivered protection if it was not already enabled.

On the least privilege point, the page asks that you give accounts only the permissions they need. The Global Administrator role is highly privileged and should be limited to emergencies.

Seeing tampering attempts

Defender for Endpoint detects potential attempts to turn off Defender Antivirus or change exclusions. Events are in the DeviceEvents table of advanced hunting, with the action type TamperingAttempt. Not every tamper event creates an alert, since uncorrelated activity may only appear in the device timeline.

What this means for developers

• Do not plan to disable real-time protection to speed up a build. Use a scoped exclusion approved through central policy, as covered in our checklist: /resources/blog/defender-exclusions-checklist-before-you-exclude-a-dev-folder.
• If a security tool you install tries to change Defender settings, expect it to be blocked and ask the vendor for the supported integration.
• On your own unmanaged machine, check the Windows Security app. Leave tamper protection on.

A quick audit

1. Pick ten devices across teams.
2. Check whether tamper protection is on, using the app or the documented PowerShell method.
3. Record any device where it is off and find out who turned it off and why.
4. Review exclusions on the same devices while you are there.

Quick check

Sources

• Tamper protection overview, Microsoft Learn
• Configure custom exclusions for Microsoft Defender Antivirus, Microsoft Learn

Last reviewed: 19 October 2026.