Tamper Protection can't be switched off, even with reg policy

infinity · Apr 3, 2022

I'm on the admin account, but I don't understand why it can't be switched off. Please share any other method that can disable this. Have already tried everything here: Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11 Tutorial

DigitalGoat · Apr 3, 2022

You cannot edit the value directly, follow the embedded link in that tutorial for changing tamper protection setting before making other changes to Defender.

Try3 · Apr 3, 2022

Have you checked the Registry Key's Permissions?
They are probably, Everyone can read, System can modify.
Hence the need to use the tutorial procedure.

Denis

infinity · Apr 4, 2022

Try3 said:
Have you checked the Registry Key's Permissions?
They are probably, Everyone can read, System can modify.
Hence the need to use the tutorial procedure.

Denis

May I know where exactly is the tutorial for this? Read this but no mention of permissions for registry:

Turn On or Off Tamper Protection for Microsoft Defender Antivirus in Windows 11

This tutorial will show you how to turn on or off Tamper Protection for Microsoft Defender Antivirus settings in Windows 11. Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats. Tamper...

www.elevenforum.com

Fabler2 · Apr 4, 2022

I have used PowerRun once to take full control of a registry key but that's a while ago. I would use with caution and create an image beforehand.

PowerRun v1.7 (Run with highest privileges)

PowerRun is a tool to launch any program/script files with the same privileges as the TrustedInstaller /SYSTEM. it is a Portable and free

www.sordum.org

Try3 · Apr 4, 2022

infinity said:
May I know where exactly is the tutorial for this?

The tutorial is as you posted.

infinity said:
Read this but no mention of permissions for registry:

I am saying that, because of the permissions applying to the relevant Registry Key, you should use the tutorial procedure instead.
To see the permissions, if that's what you are asking, right-click on the Registry Key & select Permissions.

All the best,
Denis

Comport Colin · Apr 5, 2022

The fact that you as admin cannot change the state of tamper protection can be achieved, if someone uses the Microsoft365 Defender Portal to limit what an admin may do. So if this is a company-owned machine, this could be the reason.

infinity · Apr 5, 2022

this is a PERSONAL pc, not company owned whatsoever.

the problem is still unsolved with the advice given above.

Try3 · Apr 5, 2022

So what happened when you did Step 4 of the tutorial to turn off Tamper protection?

Denis

infinity · Apr 5, 2022

nothing happened. the settings remain as-is.

Try3 · Apr 5, 2022

infinity said:
nothing happened. the settings remain as-is.

I think you need to post that fact in the tutorial thread and ask Brink for advice.

I think you will to include a brief history of Windows Defender 'customizations' on this computer since the last Windows installation and records of third-party antimalware utilities used/removed.

Best of luck,
Denis

Brink · Apr 5, 2022

Manually setting the registry for Tamper Protection will not work. The note box under step 4 was just for reference.

Tamper Protection can only be set via Windows Security to be effective.

Try3 · Apr 5, 2022

Try3 said:
So what happened when you did Step 4 of the tutorial to turn off Tamper protection?

infinity said:
nothing happened. the settings remain as-is.

You did do that Step 4? You didn't just read the dit about the Registry then stop?

Denis

Fabler2 · Apr 6, 2022

I would have run a repair install by now.

Bree · Apr 6, 2022

No one has yet noticed or commented on the fact that the OP's screenshot shows that Tamper Protection is "managed by your administrator".

As far as I am aware, this can only be done through Intune, there is no local group policy for this. @infinity do you sign in with a work or school account?

Currently the only way to manage temper protection is through intune...

Go to settings => accounts => access work or school account. You should see your school account there. If you click on it and click on 'info', you will find what Intune policies might be active

Tamper Protection managed by administrator and OFF - cannot be enabled manually when joined on-prem | Microsoft Community Hub

Hi all,We are currently only managing Microsoft Defender ATP via Group Policy and there is no GPO for tamper protection. But we cannot enable it manually...

techcommunity.microsoft.com

When an IT organization is responsible for managing a fleet of Windows 10 user endpoints, IT admins can use Microsoft Intune to turn Tamper Protection on or off for all those managed computers through the Microsoft Endpoint Manager admin center portal. Administrators will need the correct permissions, such as global or security admin, to make changes to Tamper Protection.

How to enable and disable Tamper Protection in Windows 10 | TechTarget

Microsoft introduced Tamper Protection in Windows 10, which prevents third-party applications from tampering with security settings. Learn about this new feature, including how it works with endpoint management and security tools.

www.techtarget.com

johnlgalt · Apr 6, 2022

Bree said:
No one has yet noticed or commented on the fact that the OP's screenshot shows that Tamper Protection is "managed by your administrator".

As far as I am aware, this can only be done through Intune, there is no local group policy for this. @infinity do you sign in with a work or school account?

Tamper Protection managed by administrator and OFF - cannot be enabled manually when joined on-prem | Microsoft Community Hub

Hi all,We are currently only managing Microsoft Defender ATP via Group Policy and there is no GPO for tamper protection. But we cannot enable it manually...

techcommunity.microsoft.com

How to enable and disable Tamper Protection in Windows 10 | TechTarget

Microsoft introduced Tamper Protection in Windows 10, which prevents third-party applications from tampering with security settings. Learn about this new feature, including how it works with endpoint management and security tools.

www.techtarget.com

Maybe so - but he did say this:

infinity said:
this is a PERSONAL pc, not company owned whatsoever.

the problem is still unsolved with the advice given above.

Are you enrolled in the Insiders program, or else have a work account on your system?

Comport Colin · Apr 6, 2022

Quite probably, you, at some point, imported a registry file that "hardened" your machine, or some tool did the same.
MDM/Intune policies are registry based, so you need to research where and how they manifest and simply delete that.

On the other hand: why even care? Even with tamper protection on, you may still disable defender at will.

Comport Colin · Apr 11, 2022

Please look for MDM policies here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager Go there and see if a search from there possibly finds "tamper"

Tamper Protection can't be switched off, even with reg policy

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Antidisestablishmentarianist

My Computers

Well-known member

My Computer

Well-known member

My Computer

Similar threads