Disabling Defender ATP

Question

Hi, I am struggling with disabling Windows Defender ATP, once I try to disable it from the settings (turn off real-time protection), I am unable to do so because of tamper protection, it says that this setting is managed by your administrator, and I am not able to turn off Tamper protection or even the real time protection, I tried the following solutions but non of them work:

1- Edit register values from registry editor, for this approach I was trying to modify the Tamper protection value from 1 to 0, the following error message shows : Cannot edit. Error writing the new value’s content.

2- Delete the Windows Defender registry, for this approach I was trying to delete the Windows Defender registry, but the following error message shows: Cannot delete Windows Defender: Error while deleting the key.

3- Turn off Microsoft Defender Policy, for this approach I was trying to turn it off through the group policy, but even this solution does not work.

4- Trying to turn it off through the Powershell, I tried to turn the tamper protection using the following commands : “Set-MpPreference -DisableTamperProtection $false” but it didn’t work.

Answer 1

Hello Yousef Zakarneh,

Welcome to the Microsoft Community.

It sounds like you're facing multiple barriers to disabling Windows Defender ATP and Tamper Protection. Before giving you some possible suggestions, can you give us some detailed description about your usage environment? Are you using your computer in an enterprise/organization environment? Or in other words, do you have an IT administrator? If so, you should contact the administrator to reach for further assistance.

If you are not using a working device, let’s go over potential solutions one by one and check the steps you can try to resolve the issue.

1. Group Policy Editor (GPEdit)

If you haven't already tried this in depth, Group Policy Editor is often an effective method. However, since your previous attempts to disable through Group Policy haven't worked, you might want to double-check the exact configuration:

Steps:

1. Open the Group Policy Editor: Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Real-time Protection
3. Look for "Turn off Microsoft Defender Antivirus". Double-click it and set it to Enabled.
4. Restart your computer and check if Defender is disabled.

Additionally, verify the status of Tamper Protection in the same location:

1. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Security Intelligence
2. Ensure that Tamper Protection is set to Disabled.

2. Using PowerShell (Ensure Elevated Access)

The issue with your PowerShell command (Set-MpPreference -DisableTamperProtection $false) might be that the command is being executed with insufficient privileges. Here’s what you can try:

1. Open PowerShell as Administrator: Right-click on the Start Menu, select Windows PowerShell (Admin).
2. Disable Tamper Protection: Run the following command: Set-MpPreference -DisableTamperProtection $true
3. Check Status: You can check if Tamper Protection is disabled by running: Get-MpPreference | select -expand TamperProtection

If you cannot run PowerShell in administrator mode, this means your current account does not have enough permission.

3. Registry Editor (If Allowed)

It seems that you're being blocked from editing registry values due to permissions. Since you’re getting errors such as "Cannot edit" or "Cannot delete," this may be due to the system’s integrity protection, which is enabled to prevent changes to critical settings like Tamper Protection.

To overcome this, you could try the following:

Disclaimer: Generally, modifying registry subkeys or work group is intended for advanced users, administrators, and IT Professionals. It can help fix some problems, however, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For further protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click this following link: How to back up and restore the registry in Windows - Microsoft Support 

1. Ensure You Have Full Permissions:
   • Open Registry Editor (regedit), navigate to the relevant key, right-click it, and select Permissions.
   • Click Advanced, and then make sure that your user account has full control over that registry key. If not, grant full control.
2. Force Disable via Registry (If Possible):
   • The registry key for Tamper Protection should be located at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
   • Look for the TamperProtection key and try to change its value to 0.

4. Modify Antivirus Settings via Settings App (Admin Rights)

If all the above methods fail, another way to approach this is by checking Local Security Policies or Windows Settings directly, but they may still require administrative privileges.

1. Open Windows Security from the Start Menu.
2. Go to Virus & Threat Protection > Manage Settings.
3. Turn off Real-Time Protection (if possible).
4. If Tamper Protection is enabled, it cannot be disabled from here unless you disable it via Group Policy or PowerShell as outlined above.

Disclaimer: Temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security. However, keep in mind that if you do so, your device may be vulnerable to threats. So please turn it on immediately once issue fixed. 

5. Temporary Disable via Windows Registry in Safe Mode

You could boot your machine into Safe Mode to try and disable Tamper Protection:

1. Boot into Safe Mode with Networking:
   • Restart the PC and hold down Shift while selecting Restart from the Start Menu.
   • Under Troubleshoot > Advanced Options > Startup Settings, choose Restart.
   • Once restarted, select 4 or F4 for Safe Mode.
2. Once in Safe Mode, try editing the registry or running PowerShell commands to disable Tamper Protection.

6. Check for Conflicting Software

Ensure that there are no other antivirus programs installed, as they can block attempts to disable Windows Defender. Uninstall any third-party security software and check again.

7. System Restore (Last Resort)

If nothing works, you may consider rolling back your system to a restore point before the issue occurred:

1. Open Control Panel > Recovery > Open System Restore.
2. Select a restore point before you started facing the issue.

Best Regards,

William.Y | Microsoft Community Support Specialist