Troubleshoot problems with tamper protection

Resolve common tamper protection problems on Windows and macOS devices. For an overview of protected settings, see Protect security settings with tamper protection. For setup instructions, see Configure tamper protection on Windows devices or Configure tamper protection for Microsoft Defender for Endpoint on macOS. For general questions, see Frequently asked questions about tamper protection.

Tamper protection is blocking a required change on a managed Windows device. What should I do?

Use troubleshooting mode to temporarily change tamper-protected settings on the device. The device must be online when you temporarily disable tamper protection. When troubleshooting mode expires, the temporary changes are discarded, and the settings revert to their previous policy-managed values.

Changes to Microsoft Defender Antivirus settings using Group Policy are ignored. Why is this happening, and what can we do about it?

When tamper protection is on, Group Policy changes to tamper-protected settings might appear to succeed, but tamper protection blocks the changes. For more information, see Protect security settings with tamper protection.

To make a temporary change on a device, use troubleshooting mode. To make permanent changes, adjust the tamper protection policy or exclude the affected devices from tamper protection through Intune or Configuration Manager. For policy configuration details, see Configure tamper protection on Windows devices.

Why does tamper protection appear as Not applicable?

Devices must be onboarded to Microsoft Defender for Endpoint before you configure tamper protection through Intune or the Microsoft Defender portal. If a device isn't onboarded, tamper protection appears as Not applicable until onboarding is complete. See Device onboarding requirement.

Why did Microsoft Defender Antivirus generate Event ID 5013?

Event ID 5013 means tamper protection blocked a change to a Microsoft Defender Antivirus setting. The event identifies the setting that the attempted action tried to change. See Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus.

Why aren't Microsoft Defender Antivirus exclusions tamper protected?

Exclusion protection requires a supported Microsoft Defender platform version, the DisableLocalAdminMerge setting, a supported device-management state, and centrally managed exclusions. Verify the requirements and the TPExclusions registry value in Protect Microsoft Defender Antivirus exclusions with tamper protection.

How do I protect exclusions for Microsoft Defender Antivirus?

See Protect Microsoft Defender Antivirus exclusions with tamper protection for requirements and verification steps.

Tamper protection is reported as disabled on a macOS device. How do I troubleshoot it?

If mdatp health reports that tamper protection is disabled more than an hour after you enabled tamper protection and onboarded the device, retrieve detailed status information. The following command reports the effective mode, configuration source, and managed exclusions:

mdatp health --details tamper_protection

The following sample output shows the current tamper protection mode, configuration source, and any managed exclusions delivered by policy. Verify that tamper_protection and configuration_source match your intended configuration:

tamper_protection                           : "audit"
exclusions                                  : [{"path":"/usr/bin/ruby","team_id":"","signing_id":"com.apple.ruby","args":["/usr/local/bin/global_mdatp_restarted.rb"]}] [managed]
feature_enabled_protection                  : true
feature_enabled_portal                      : true
configuration_source                        : "local"
configuration_local                         : "audit"
configuration_portal                        : "block"
configuration_default                       : "audit"
configuration_is_managed                    : false

• tamper_protection is the effective mode. If the value matches the intended mode, tamper protection is configured correctly.
• configuration_source identifies the source that sets the effective enforcement level. The value should match the method you used to configure tamper protection. If you used a managed profile but the value isn't mdm, check the profile configuration.
  • mdm: A managed profile configures the mode. Only a Security Administrator can change the mode by updating the profile.
  • local: The mdatp config command configures the mode.
  • portal: The Microsoft Defender portal configures the default enforcement level.
  • defaults: No source configures the mode, so Defender for Endpoint uses the default mode.
• If feature_enabled_protection is false, tamper protection isn't enabled for the organization. This value can occur if Defender for Endpoint doesn't report the device as licensed.
• If feature_enabled_portal is false, configuring the default mode in the Microsoft Defender portal isn't enabled for the organization.
• configuration_local, configuration_portal, and configuration_default show the modes that each configuration source would apply. For example, an MDM profile can set block mode while configuration_default reports audit mode. If you remove the MDM profile and no local or portal setting applies, Defender for Endpoint uses the reported default mode.

Note

Before version 101.98.71 (May 2023), inspect the Defender for Endpoint logs to get the same information. Run the following command to confirm the most recent tamper protection feature-state entry in the Defender core log:

sudo grep -F '[{tamperProtection}]: Feature state:' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log | tail -n 1

Resolve common tamper protection problems on Windows and macOS devices. For an overview of protected settings, see Protect security settings with tamper protection. For setup instructions, see Configure tamper protection on Windows devices or Configure tamper protection for Microsoft Defender for Endpoint on macOS. For general questions, see Frequently asked questions about tamper protection.

Use troubleshooting mode to temporarily change tamper-protected settings on the device. The device must be online when you temporarily disable tamper protection. When troubleshooting mode expires, the temporary changes are discarded, and the settings revert to their previous policy-managed values.

When tamper protection is on, Group Policy changes to tamper-protected settings might appear to succeed, but tamper protection blocks the changes. For more information, see Protect security settings with tamper protection.

To make a temporary change on a device, use troubleshooting mode. To make permanent changes, adjust the tamper protection policy or exclude the affected devices from tamper protection through Intune or Configuration Manager. For policy configuration details, see Configure tamper protection on Windows devices.

Devices must be onboarded to Microsoft Defender for Endpoint before you configure tamper protection through Intune or the Microsoft Defender portal. If a device isn't onboarded, tamper protection appears as Not applicable until onboarding is complete. See Device onboarding requirement.

Event ID 5013 means tamper protection blocked a change to a Microsoft Defender Antivirus setting. The event identifies the setting that the attempted action tried to change. See Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus.

Exclusion protection requires a supported Microsoft Defender platform version, the DisableLocalAdminMerge setting, a supported device-management state, and centrally managed exclusions. Verify the requirements and the TPExclusions registry value in Protect Microsoft Defender Antivirus exclusions with tamper protection.

See Protect Microsoft Defender Antivirus exclusions with tamper protection for requirements and verification steps.

If mdatp health reports that tamper protection is disabled more than an hour after you enabled tamper protection and onboarded the device, retrieve detailed status information. The following command reports the effective mode, configuration source, and managed exclusions:

mdatp health --details tamper_protection

The following sample output shows the current tamper protection mode, configuration source, and any managed exclusions delivered by policy. Verify that tamper_protection and configuration_source match your intended configuration:

tamper_protection                           : "audit"
exclusions                                  : [{"path":"/usr/bin/ruby","team_id":"","signing_id":"com.apple.ruby","args":["/usr/local/bin/global_mdatp_restarted.rb"]}] [managed]
feature_enabled_protection                  : true
feature_enabled_portal                      : true
configuration_source                        : "local"
configuration_local                         : "audit"
configuration_portal                        : "block"
configuration_default                       : "audit"
configuration_is_managed                    : false

• tamper_protection is the effective mode. If the value matches the intended mode, tamper protection is configured correctly.
• configuration_source identifies the source that sets the effective enforcement level. The value should match the method you used to configure tamper protection. If you used a managed profile but the value isn't mdm, check the profile configuration.
  • mdm: A managed profile configures the mode. Only a Security Administrator can change the mode by updating the profile.
  • local: The mdatp config command configures the mode.
  • portal: The Microsoft Defender portal configures the default enforcement level.
  • defaults: No source configures the mode, so Defender for Endpoint uses the default mode.
• If feature_enabled_protection is false, tamper protection isn't enabled for the organization. This value can occur if Defender for Endpoint doesn't report the device as licensed.
• If feature_enabled_portal is false, configuring the default mode in the Microsoft Defender portal isn't enabled for the organization.
• configuration_local, configuration_portal, and configuration_default show the modes that each configuration source would apply. For example, an MDM profile can set block mode while configuration_default reports audit mode. If you remove the MDM profile and no local or portal setting applies, Defender for Endpoint uses the reported default mode.

Note

Before version 101.98.71 (May 2023), inspect the Defender for Endpoint logs to get the same information. Run the following command to confirm the most recent tamper protection feature-state entry in the Defender core log:

sudo grep -F '[{tamperProtection}]: Feature state:' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log | tail -n 1