One of the first things a modern attacker does after landing on a device is try to switch off the antivirus. If they can disable real-time protection, add a broad exclusion or stop cloud lookups, everything that follows gets easier. Defender tamper protection exists to stop exactly that. It locks the key Microsoft Defender settings so they cannot be changed locally, even by someone with admin rights on the device.
This article explains how attackers go after Defender, what tamper protection protects, how to turn it on through Intune or the Defender portal, and the small number of gotchas that trip people up.
How attackers try to disable Defender
Ransomware operators and hands-on-keyboard attackers follow a familiar playbook once they have admin access on a machine. The goal is to blind the security tools before the noisy part of the attack begins. Common techniques include:
PowerShell commands that turn off real-time monitoring, behavior monitoring or script scanning.
Registry edits that set Defender policy keys to disable protection.
Adding exclusions for an entire drive, a temp folder or a file extension, so malware runs unseen while Defender looks healthy.
Stopping or disabling services and scheduled tasks that Defender depends on.
Abusing vulnerable signed drivers to kill security processes from kernel level.
The worrying part is how quiet some of these are. A broad exclusion does not raise an obvious alarm. The device still shows Defender as on. In incident reviews, finding an unexplained exclusion added shortly before the encryption started is a common pattern.
What tamper protection protects
When tamper protection is on, Windows blocks changes to core Defender settings that do not come from your management tool. Protected areas include:
Real-time protection and behavior monitoring.
Cloud-delivered protection.
Antivirus protection itself, including attempts to turn it off through policy keys.
IOfficeAntivirus (IOAV) scanning of downloaded files.
Security intelligence updates.
Under the right conditions, the antivirus exclusion lists you manage centrally.
Changes made through your management channel, such as Intune policy, still apply. Changes attempted locally through PowerShell, the registry or the Windows Security app are blocked, and Windows can log event ID 5013 when a change is stopped.
Tamper protection does not stop every technique. Kernel-level attacks with vulnerable drivers are a separate problem, which is why the attack surface reduction rule that blocks abuse of exploited vulnerable signed drivers belongs in the same baseline.
Requirements before you turn it on
Check these first, because most “tamper protection is not working” tickets come from a missed prerequisite:
Requirement
Detail
Onboarded to Defender
Devices must be onboarded to Defender for Endpoint (Plan 1, Plan 2 or Defender for Business). Before onboarding, the setting shows as not applicable.
Defender Antivirus active
Defender must be the primary antivirus with current platform and engine updates.
Cloud-delivered protection
Needs to be on so the enabled state can be controlled. Recent platform versions turn it on automatically with tamper protection.
Intune management
For the Intune method, devices are managed by Intune and Intune and Defender share the same Entra tenant. Microsoft lists co-managed devices as unsupported for this method.
Exclusion protection
To protect exclusions, Microsoft documents extra conditions, including setting DisableLocalAdminMerge so local admins cannot add their own exclusions.
Turning on Defender tamper protection
Option 1: Tenant-wide in the Defender portal
The quickest way is the tenant-wide switch. In the Microsoft Defender portal, go to Settings > Endpoints > Advanced features and turn on Tamper protection. This applies to all onboarded Windows devices. Many tenants already have this on by default, but I still check it in every review.
Option 2: Targeted with Intune
If you want control by group, or you want the setting visible alongside your other endpoint policies, use Intune:
Go to Endpoint security > Antivirus > Create Policy.
Platform: Windows. Profile: Windows Security Experience.
Under Defender, set Tamper protection (device) to On.
Assign to all Windows devices, or a pilot group first.
An Intune policy for a device takes priority over the tenant-wide switch. Do not use Intune to turn it off for a group unless you have a documented reason.
One naming note: Microsoft has started renaming the tamper protection setting in some management screens to controlled configuration, a broader feature that builds on tamper protection. The rename alone does not turn on the extra controlled configuration protections. If the label looks different in your admin center, check the current Microsoft Learn page before assuming the setting has gone.
Exclusions: the part most people miss
Because attackers love adding exclusions, protecting your exclusion list is worth the extra effort. The practical steps are:
Manage all antivirus exclusions from Intune, not locally or by Group Policy.
Set DisableLocalAdminMerge to true in your Defender antivirus policy so local admins cannot add their own exclusions on top of yours.
Keep the exclusion list short and specific. Review it quarterly.
Confirm the device meets the current Microsoft requirements for exclusion protection.
Even with tamper protection on, review the exclusions you push yourself. A broad exclusion you deploy centrally is just as useful to an attacker as one they add locally.
When IT genuinely needs to change a setting
Sometimes a technician needs to change Defender settings on a single machine to troubleshoot performance or an app conflict. Do not switch tamper protection off tenant-wide for that. Use troubleshooting mode in the Defender portal instead. It lets an admin change settings on one device for a limited time window, then reverts automatically, and the action is logged.
How to check it is working
On a device, run Get-MpComputerStatus in PowerShell and confirm IsTamperProtected is True.
Try to turn off real-time protection with Set-MpPreference -DisableRealtimeMonitoring $true on a test device. It should not take effect.
In the Defender portal, check the device inventory and security recommendations for any devices where tamper protection is off.
In Intune, check the antivirus policy status for errors or conflicts.
Tamper protection is one setting, but it protects every other setting. It belongs in every Windows baseline. Our Defender for Endpoint service includes it with onboarding and policy tuning, and our endpoint security baseline covers the related Defender, ASR and firewall settings. If you want someone watching for disabled protections around the clock, see our managed security service.
Does Defender tamper protection stop a local administrator?
Yes, for the protected settings. A local admin cannot turn off real-time protection or cloud protection through PowerShell, the registry or the Windows Security app while tamper protection is on. Changes from your management tool still apply.
Is tamper protection included with Business Premium?
Yes. Business Premium includes Microsoft Defender for Business, and devices onboarded to it support tamper protection managed from the Defender portal or Intune.
How do I change Defender settings on one device for troubleshooting?
Use troubleshooting mode from the device page in the Defender portal. It allows temporary local changes on that device only and then switches protection back automatically.
Want to know whether any of your devices have Defender quietly weakened or switched off? Book a free Microsoft 365 security assessment and we will check your endpoint protection settings across the fleet.
One of the first things a modern attacker does after landing on a device is try to switch off the antivirus. If they can disable real-time protection, add a broad exclusion or stop cloud lookups, everything that follows gets easier. Defender tamper protection exists to stop exactly that. It locks the key Microsoft Defender settings so they cannot be changed locally, even by someone with admin rights on the device.
This article explains how attackers go after Defender, what tamper protection protects, how to turn it on through Intune or the Defender portal, and the small number of gotchas that trip people up.
How attackers try to disable Defender
Ransomware operators and hands-on-keyboard attackers follow a familiar playbook once they have admin access on a machine. The goal is to blind the security tools before the noisy part of the attack begins. Common techniques include:
The worrying part is how quiet some of these are. A broad exclusion does not raise an obvious alarm. The device still shows Defender as on. In incident reviews, finding an unexplained exclusion added shortly before the encryption started is a common pattern.
What tamper protection protects
When tamper protection is on, Windows blocks changes to core Defender settings that do not come from your management tool. Protected areas include:
Changes made through your management channel, such as Intune policy, still apply. Changes attempted locally through PowerShell, the registry or the Windows Security app are blocked, and Windows can log event ID 5013 when a change is stopped.
Tamper protection does not stop every technique. Kernel-level attacks with vulnerable drivers are a separate problem, which is why the attack surface reduction rule that blocks abuse of exploited vulnerable signed drivers belongs in the same baseline.
Requirements before you turn it on
Check these first, because most “tamper protection is not working” tickets come from a missed prerequisite:
DisableLocalAdminMergeso local admins cannot add their own exclusions.Turning on Defender tamper protection
Option 1: Tenant-wide in the Defender portal
The quickest way is the tenant-wide switch. In the Microsoft Defender portal, go to
Settings > Endpoints > Advanced featuresand turn on Tamper protection. This applies to all onboarded Windows devices. Many tenants already have this on by default, but I still check it in every review.Option 2: Targeted with Intune
If you want control by group, or you want the setting visible alongside your other endpoint policies, use Intune:
Endpoint security > Antivirus > Create Policy.An Intune policy for a device takes priority over the tenant-wide switch. Do not use Intune to turn it off for a group unless you have a documented reason.
One naming note: Microsoft has started renaming the tamper protection setting in some management screens to controlled configuration, a broader feature that builds on tamper protection. The rename alone does not turn on the extra controlled configuration protections. If the label looks different in your admin center, check the current Microsoft Learn page before assuming the setting has gone.
Exclusions: the part most people miss
Because attackers love adding exclusions, protecting your exclusion list is worth the extra effort. The practical steps are:
DisableLocalAdminMergeto true in your Defender antivirus policy so local admins cannot add their own exclusions on top of yours.Even with tamper protection on, review the exclusions you push yourself. A broad exclusion you deploy centrally is just as useful to an attacker as one they add locally.
When IT genuinely needs to change a setting
Sometimes a technician needs to change Defender settings on a single machine to troubleshoot performance or an app conflict. Do not switch tamper protection off tenant-wide for that. Use troubleshooting mode in the Defender portal instead. It lets an admin change settings on one device for a limited time window, then reverts automatically, and the action is logged.
How to check it is working
Get-MpComputerStatusin PowerShell and confirmIsTamperProtectedisTrue.Set-MpPreference -DisableRealtimeMonitoring $trueon a test device. It should not take effect.Tamper protection is one setting, but it protects every other setting. It belongs in every Windows baseline. Our Defender for Endpoint service includes it with onboarding and policy tuning, and our endpoint security baseline covers the related Defender, ASR and firewall settings. If you want someone watching for disabled protections around the clock, see our managed security service.
Microsoft’s reference: Tamper protection overview.
Frequently asked questions
Does Defender tamper protection stop a local administrator?
Yes, for the protected settings. A local admin cannot turn off real-time protection or cloud protection through PowerShell, the registry or the Windows Security app while tamper protection is on. Changes from your management tool still apply.
Is tamper protection included with Business Premium?
Yes. Business Premium includes Microsoft Defender for Business, and devices onboarded to it support tamper protection managed from the Defender portal or Intune.
How do I change Defender settings on one device for troubleshooting?
Use troubleshooting mode from the device page in the Defender portal. It allows temporary local changes on that device only and then switches protection back automatically.
Want to know whether any of your devices have Defender quietly weakened or switched off? Book a free Microsoft 365 security assessment and we will check your endpoint protection settings across the fleet.