Tamper Protection can't be switched off, even with reg policy


infinity

Well-known member
VIP
Local time
4:58 AM
Posts
110
OS
Win 11
LyQMQqX.png

4UCAEVn.png


WCDC6Jl.png





I'm on the admin account, but I don't understand why it can't be switched off. Please share any other method that can disable this. Have already tried everything here: Enable or Disable Real-time Protection for Microsoft Defender Antivirus in Windows 11 Tutorial
 

My Computer My Computer

At a glance

Win 11Ryzen 3600GSkill RipJawz 16Gbx2GTX960
OS
Win 11
Computer type
PC/Desktop
CPU
Ryzen 3600
Motherboard
MSI B450 Tomahawk Max
Memory
GSkill RipJawz 16Gbx2
Graphics Card(s)
GTX960
Screen Resolution
2560x1440
Hard Drives
WD750 SSD 1TB
PSU
650w FSP
You cannot edit the value directly, follow the embedded link in that tutorial for changing tamper protection setting before making other changes to Defender.
 

My Computer My Computer

At a glance

Windows 11 Pro 22H2, build: 22621.521Intel i7-12700K 3.6GHz Base (5.0GHz Turbo)64GB DDR 3600MhzAsus Tuff RTX 3080 10GB OC
OS
Windows 11 Pro 22H2, build: 22621.521
Computer type
PC/Desktop
Manufacturer/Model
Scan 3XS Custom 1700
CPU
Intel i7-12700K 3.6GHz Base (5.0GHz Turbo)
Motherboard
Asus ProArt Creator B660 D4
Memory
64GB DDR 3600Mhz
Graphics Card(s)
Asus Tuff RTX 3080 10GB OC
Sound Card
Onboard Realtek
Monitor(s) Displays
Gigabyte G32QC 32inch 16:9 curved @2560 x 1440p 165Hz Freesync Premium Pro/ Dell SE2422H 24inch 16:9 1920 x 1080p 75Hz Freesync
Screen Resolution
2560 x 1440p & 1920 x 1080p
Hard Drives
WD SN570 1TB NVME (Boot), Samsung 870QVO 1TB (SSD), SanDisk 3D Ultra 500Gb (SSD) x2, Seagate 3Tb Expansion Desk (Ext HDD), 2x Toshiba 1Tb P300 (Ext HDD)
PSU
Corsair RM1000X Modular
Case
Corsair 4000D Airflow Desktop
Cooling
Corsair Hydro H150i RGB Pro XT 360mm Liquid Cooler, 3 x 120mm fans, 1x Exhaust
Keyboard
Microsoft Ergonomic
Mouse
Logitech G402
Internet Speed
800Mbs
Browser
Edge Chromium
Antivirus
Defender, Malwarebytes
Have you checked the Registry Key's Permissions?
They are probably, Everyone can read, System can modify.
Hence the need to use the tutorial procedure.

Denis
 

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
Have you checked the Registry Key's Permissions?
They are probably, Everyone can read, System can modify.
Hence the need to use the tutorial procedure.

Denis
May I know where exactly is the tutorial for this? Read this but no mention of permissions for registry:

 

My Computer My Computer

At a glance

Win 11Ryzen 3600GSkill RipJawz 16Gbx2GTX960
OS
Win 11
Computer type
PC/Desktop
CPU
Ryzen 3600
Motherboard
MSI B450 Tomahawk Max
Memory
GSkill RipJawz 16Gbx2
Graphics Card(s)
GTX960
Screen Resolution
2560x1440
Hard Drives
WD750 SSD 1TB
PSU
650w FSP
I have used PowerRun once to take full control of a registry key but that's a while ago. I would use with caution and create an image beforehand.

 

My Computers My Computers

  • At a glance

    Win 11 ProAMD Ryzen™ 7 7730U24GB Dual-Channel DDR4 @ 1596MHz (22-22-22-52)512MB ATI AMD Radeon Graphics (ASUStek Comput...
    OS
    Win 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook
    CPU
    AMD Ryzen™ 7 7730U
    Motherboard
    M1605YA
    Memory
    24GB Dual-Channel DDR4 @ 1596MHz (22-22-22-52)
    Graphics Card(s)
    512MB ATI AMD Radeon Graphics (ASUStek Computer Inc)
    Monitor(s) Displays
    Generic PnP Monitor (1920x1200@60Hz) - P1 PLUS (1920x1080@59Hz)
    Screen Resolution
    1920 X 1200
    Hard Drives
    953GB Western Digital WD
    PSU
    45 Watts
    Mouse
    Lenovo Bluetooth.
    Internet Speed
    500 Mbps
    Browser
    Edge
    Antivirus
    Defender
  • At a glance

    Windows 11AMD Ryzen 7 5800H / 3.2 GHz32 GB DDR4 SDRAM 3200 MHzNVIDIA GeForce RTX 3060 6 GB GDDR6 SDRAM
    Operating System
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    ACER NITRO
    CPU
    AMD Ryzen 7 5800H / 3.2 GHz
    Motherboard
    CZ Scala_CAS (FP6)
    Memory
    32 GB DDR4 SDRAM 3200 MHz
    Graphics card(s)
    NVIDIA GeForce RTX 3060 6 GB GDDR6 SDRAM
    Sound Card
    Realtek Audio. NVIDIA High Definition Audio
    Monitor(s) Displays
    15.6" LED backlight 1920 x 1080 (Full HD) 144 Hz
    Screen Resolution
    1920 x 1080 (Full HD)
    Hard Drives
    Samsung 970 Evo Plus 2TB NVMe M.2
    PSU
    180 Watt, 19.5 V
    Mouse
    Lenovo Bluetooth
    Internet Speed
    500 Mbps
    Browser
    Edge
    Antivirus
    Defender
May I know where exactly is the tutorial for this?
The tutorial is as you posted.

Read this but no mention of permissions for registry:
I am saying that, because of the permissions applying to the relevant Registry Key, you should use the tutorial procedure instead.
To see the permissions, if that's what you are asking, right-click on the Registry Key & select Permissions.

All the best,
Denis
 

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
The fact that you as admin cannot change the state of tamper protection can be achieved, if someone uses the Microsoft365 Defender Portal to limit what an admin may do. So if this is a company-owned machine, this could be the reason.
 

My Computer My Computer

At a glance

Win11
OS
Win11
this is a PERSONAL pc, not company owned whatsoever.

the problem is still unsolved with the advice given above.
 

My Computer My Computer

At a glance

Win 11Ryzen 3600GSkill RipJawz 16Gbx2GTX960
OS
Win 11
Computer type
PC/Desktop
CPU
Ryzen 3600
Motherboard
MSI B450 Tomahawk Max
Memory
GSkill RipJawz 16Gbx2
Graphics Card(s)
GTX960
Screen Resolution
2560x1440
Hard Drives
WD750 SSD 1TB
PSU
650w FSP
So what happened when you did Step 4 of the tutorial to turn off Tamper protection?

Denis
 

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
nothing happened. the settings remain as-is.
 

My Computer My Computer

At a glance

Win 11Ryzen 3600GSkill RipJawz 16Gbx2GTX960
OS
Win 11
Computer type
PC/Desktop
CPU
Ryzen 3600
Motherboard
MSI B450 Tomahawk Max
Memory
GSkill RipJawz 16Gbx2
Graphics Card(s)
GTX960
Screen Resolution
2560x1440
Hard Drives
WD750 SSD 1TB
PSU
650w FSP
nothing happened. the settings remain as-is.

I think you need to post that fact in the tutorial thread and ask Brink for advice.

I think you will to include a brief history of Windows Defender 'customizations' on this computer since the last Windows installation and records of third-party antimalware utilities used/removed.

Best of luck,
Denis
 

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
Manually setting the registry for Tamper Protection will not work. The note box under step 4 was just for reference.

Tamper Protection can only be set via Windows Security to be effective.
 

My Computers My Computers

  • At a glance

    Windows 11 Pro for WorkstationsIntel i7-8700K 5 GHz64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600...ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GD...
    OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    TerraMaster F8 SSD Plus NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Amazon Basics Wired Full Keyboard MD005
    Mouse
    Logitech MX Master 4
    Internet Speed
    2 Gbps Download and 100 Mbps Upload
    Browser
    Chrome and Edge
    Antivirus
    Microsoft Defender
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone
  • At a glance

    Windows 11 ProSnapdragon X Elite (12 core) 3.42 GHz16 GB LPDDR5x-7467 MHz
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Microsoft Defender

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
I would have run a repair install by now.
 

My Computers My Computers

  • At a glance

    Win 11 ProAMD Ryzen™ 7 7730U24GB Dual-Channel DDR4 @ 1596MHz (22-22-22-52)512MB ATI AMD Radeon Graphics (ASUStek Comput...
    OS
    Win 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook
    CPU
    AMD Ryzen™ 7 7730U
    Motherboard
    M1605YA
    Memory
    24GB Dual-Channel DDR4 @ 1596MHz (22-22-22-52)
    Graphics Card(s)
    512MB ATI AMD Radeon Graphics (ASUStek Computer Inc)
    Monitor(s) Displays
    Generic PnP Monitor (1920x1200@60Hz) - P1 PLUS (1920x1080@59Hz)
    Screen Resolution
    1920 X 1200
    Hard Drives
    953GB Western Digital WD
    PSU
    45 Watts
    Mouse
    Lenovo Bluetooth.
    Internet Speed
    500 Mbps
    Browser
    Edge
    Antivirus
    Defender
  • At a glance

    Windows 11AMD Ryzen 7 5800H / 3.2 GHz32 GB DDR4 SDRAM 3200 MHzNVIDIA GeForce RTX 3060 6 GB GDDR6 SDRAM
    Operating System
    Windows 11
    Computer type
    Laptop
    Manufacturer/Model
    ACER NITRO
    CPU
    AMD Ryzen 7 5800H / 3.2 GHz
    Motherboard
    CZ Scala_CAS (FP6)
    Memory
    32 GB DDR4 SDRAM 3200 MHz
    Graphics card(s)
    NVIDIA GeForce RTX 3060 6 GB GDDR6 SDRAM
    Sound Card
    Realtek Audio. NVIDIA High Definition Audio
    Monitor(s) Displays
    15.6" LED backlight 1920 x 1080 (Full HD) 144 Hz
    Screen Resolution
    1920 x 1080 (Full HD)
    Hard Drives
    Samsung 970 Evo Plus 2TB NVMe M.2
    PSU
    180 Watt, 19.5 V
    Mouse
    Lenovo Bluetooth
    Internet Speed
    500 Mbps
    Browser
    Edge
    Antivirus
    Defender
No one has yet noticed or commented on the fact that the OP's screenshot shows that Tamper Protection is "managed by your administrator".

LyQMQqX.png



As far as I am aware, this can only be done through Intune, there is no local group policy for this. @infinity do you sign in with a work or school account?

Currently the only way to manage temper protection is through intune...
Go to settings => accounts => access work or school account. You should see your school account there. If you click on it and click on 'info', you will find what Intune policies might be active


When an IT organization is responsible for managing a fleet of Windows 10 user endpoints, IT admins can use Microsoft Intune to turn Tamper Protection on or off for all those managed computers through the Microsoft Endpoint Manager admin center portal. Administrators will need the correct permissions, such as global or security admin, to make changes to Tamper Protection.
 

My Computers My Computers

  • At a glance

    Windows 11 HomeAMD Athlon Silver 3050U8GBRadeon Graphics
    OS
    Windows 11 Home
    Computer type
    Laptop
    Manufacturer/Model
    Acer Aspire 3 A315-23-R9VY
    CPU
    AMD Athlon Silver 3050U
    Memory
    8GB
    Graphics Card(s)
    Radeon Graphics
    Monitor(s) Displays
    laptop screen
    Screen Resolution
    1366x768 native resolution, up to 2560x1440 with Radeon Virtual Super Resolution
    Hard Drives
    1TB Samsung EVO 870 SSD (from April 2026: 250GB EVO 850)
    Internet Speed
    150 Mbps
    Browser
    Edge, Firefox
    Antivirus
    Defender
    Other Info
    fully 'Windows 11 ready' laptop. Windows 10 C: partition migrated from my old unsupported 'main machine' then upgraded to 11. A test migration ran Insider builds for 2 months. When 11 was released on 5th October 2021 it was re-imaged back to 10 and was offered the upgrade in Windows Update on 20th October. Windows Update offered the 22H2 Feature Update on 20th September 2022. It got the 23H2 Feature Update on 4th November 2023 through Windows Update, 24H2 on 3rd October 2024 through Windows Update by setting the Target Release Version for 24H2, and 25H2 on 30th September 2025 through Windows Update by setting the Target Release Version for 25H2.

    UPDATE - 11 April 2026: due to mechanical deterioration this PC has been retired from active duty. The OS with all software and files has been migrated to my System Seven in 'Other systems' to carry on as my general purpose 'main machine'.
  • At a glance

    Windows 11 ProIntel® Core™ i5-520M8GB(integrated graphics) Intel HD Graphics
    Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell Latitude E4310
    CPU
    Intel® Core™ i5-520M
    Motherboard
    0T6M8G
    Memory
    8GB
    Graphics card(s)
    (integrated graphics) Intel HD Graphics
    Screen Resolution
    1366x768
    Hard Drives
    500GB Crucial MX500 SSD
    Browser
    Firefox, Edge
    Antivirus
    Defender
    Other Info
    unsupported machine: Legacy bios, MBR, TPM 1.2, upgraded from W10 to W11 using W10/W11 hybrid install media workaround.

    In-place upgrade to 22H2 using ISO and a workaround.
    Feature Update to 23H2 by manually installing the Enablement Package.
    In-place upgrade to 24H2 using hybrid 23H2/24H2 install media.
    Upgraded to 25H2 by Enablement Package.

    Also running Insider Dev, and Canary builds and Windows 10 as native boot .vhdx.
  • My SYSTEM THREE is a Dell Latitude 5410, i7-10610U, 32GB RAM, 512GB NVMe ssd, supported device running Windows 11 Pro.

    My SYSTEM FOUR is a 2-in-1 convertible Lenovo Yoga 11e 20DA, Celeron N2930, 8GB RAM, 256GB ssd. Unsupported device: currently running Win10 Pro, plus Win11 Pro RTM and Insider Dev, Beta, and RP 24H2 as native boot vhdx.

    My SYSTEM FIVE is a Dell Latitude 3190 2-in-1, Pentium Silver N5030, 8GB RAM, 1TB NVMe ssd, supported device running Windows 11 Pro, plus Insider Beta, Dev, and Canary builds (and a few others) as a native boot .vhdx.

    My SYSTEM SIX is a Dell Latitude 5550, Core Ultra 7 165H, 64GB RAM, 1TB NVMe SSD, supported device, Windows 11 Pro 24H2, Hyper-V host machine. Updated to 25H2 on 30th September 2025.

    My SYSTEM SEVEN is a Lenovo Thinkpad T580, Intel Core i7-8650U, 16GB RAM, 512GB NVMe SSD + 2nd 512GB NVMe SSD, a supported device for Windows 11. This is my current general purpose 'main machine'. The installed Windows 11 Home from my System One has been migrated to this machine.
No one has yet noticed or commented on the fact that the OP's screenshot shows that Tamper Protection is "managed by your administrator".

LyQMQqX.png



As far as I am aware, this can only be done through Intune, there is no local group policy for this. @infinity do you sign in with a work or school account?







Maybe so - but he did say this:

this is a PERSONAL pc, not company owned whatsoever.

the problem is still unsolved with the advice given above.

Are you enrolled in the Insiders program, or else have a work account on your system?
 

My Computers My Computers

  • At a glance

    Windows 11 23H2 Current buildAMD Ryzen 9 3950X4 * 32 GB - Corsair Vengeance 3600 MHzEVGA GeForce RTX 3080 Ti XC3 ULTRA GAMING (12...
    OS
    Windows 11 23H2 Current build
    Computer type
    PC/Desktop
    Manufacturer/Model
    HomeBrew
    CPU
    AMD Ryzen 9 3950X
    Motherboard
    MSI MEG X570 GODLIKE
    Memory
    4 * 32 GB - Corsair Vengeance 3600 MHz
    Graphics Card(s)
    EVGA GeForce RTX 3080 Ti XC3 ULTRA GAMING (12G-P5-3955-KR)
    Sound Card
    Realtek® ALC1220 Codec
    Monitor(s) Displays
    2x Eve Spectrum ES07D03 4K Gaming Monitor (Matte) | Eve Spectrum ES07DC9 4K Gaming Monitor (Glossy)
    Screen Resolution
    3x 3840 x 2160
    Hard Drives
    3x Samsung 980 Pro NVMe PCIe 4 M.2 2 TB SSD (MZ-V8P2T0B/AM) } 3x Sabrent Rocket NVMe 4.0 1 TB SSD (USB)
    PSU
    PC Power & Cooling’s Silencer Series 1050 Watt, 80 Plus Platinum
    Case
    Fractal Design Define 7 XL Dark ATX Full Tower Case
    Cooling
    Arctic Liquid Freezer III 420 RGB + Air 3x 140mm case fans (pull front) + 1x 120 mm (push back) and 1 x 120 mm (pull bottom)
    Keyboard
    SteelSeries Apex Pro Wired Gaming Keyboard
    Mouse
    Logitech MX Master 3S | MX Master 3 for Business
    Internet Speed
    AT&T LightSpeed Gigabit Duplex Ftth
    Browser
    Nightly (default) + Firefox (stable), Chrome, Edge , Arc
    Antivirus
    Defender + MB 5 Beta
  • At a glance

    ChromeOS Flex Dev Channel (current)Intel(R) Core(TM) i5-6300U CPU @ 2.40GHz, 250...16 GBIntel(R) HD Graphics 520
    Operating System
    ChromeOS Flex Dev Channel (current)
    Computer type
    Laptop
    Manufacturer/Model
    Dell Latitude E5470
    CPU
    Intel(R) Core(TM) i5-6300U CPU @ 2.40GHz, 2501 Mhz, 2 Core(s), 4 Logical Processor(s)
    Motherboard
    Dell
    Memory
    16 GB
    Graphics card(s)
    Intel(R) HD Graphics 520
    Sound Card
    Intel(R) HD Graphics 520 + RealTek Audio
    Monitor(s) Displays
    Dell laptop display 15"
    Screen Resolution
    1920 * 1080
    Hard Drives
    Toshiba 128GB M.2 22300 drive
    INTEL Cherryville 520 Series SSDSC2CW180A 180 GB SATA III SSD
    PSU
    Dell
    Case
    Dell
    Cooling
    Dell
    Keyboard
    Dell
    Mouse
    Logitech MX Master 3S (shared w. Sys 1) | Dell TouchPad
    Internet Speed
    AT&T LightSpeed Gigabit Duplex Ftth
Quite probably, you, at some point, imported a registry file that "hardened" your machine, or some tool did the same.
MDM/Intune policies are registry based, so you need to research where and how they manifest and simply delete that.

On the other hand: why even care? Even with tamper protection on, you may still disable defender at will.
 

My Computer My Computer

At a glance

Win11
OS
Win11
Please look for MDM policies here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager Go there and see if a search from there possibly finds "tamper"
 

My Computer My Computer

At a glance

Win11
OS
Win11
Back
Top Bottom