Glossary
Tamper protection
A Microsoft Defender setting that prevents local changes to key antivirus settings, even by administrators, so attackers cannot simply switch it off.
Tamper protection locks critical Microsoft Defender Antivirus settings so they cannot be changed through the registry, PowerShell, Group Policy or the Windows Security app on the device. Protected settings include real-time protection, behavior monitoring, cloud-delivered protection, IOAV (scanning of downloaded files), security intelligence updates and, when managed only by Intune or only by Configuration Manager with the prerequisites met, exclusions. When a change is blocked, Defender keeps its configuration and, with Defender for Endpoint, raises an alert. It can be managed tenant-wide from the Microsoft Defender portal, through Intune or Configuration Manager, or enabled locally on unmanaged consumer devices.
Disabling antivirus is one of the first things ransomware operators do after gaining administrator rights. Tamper protection turns that into a noisy, failed action instead of a silent one. Enable it everywhere, manage exclusions centrally rather than locally, and alert on tamper attempts. Remember that it does not protect against kernel-level attacks, so combine it with the vulnerable driver blocklist and memory integrity.
See Hardening Microsoft Defender Antivirus and Auditing Defender exclusions.