Frequently asked questions (FAQs) about tamper protection

Devices must meet all of the following requirements:

• Devices must be running certain versions of Windows or macOS. (See On what devices can tamper protection be enabled?)
• Devices must be onboarded to Microsoft Defender for Endpoint.
• Devices must be using anti-malware platform version 4.18.2010.7 (or later) and anti-malware engine version 1.1.17600.5 (or later). (Manage Microsoft Defender Antivirus updates and apply baselines.)
• Cloud-delivered protection must be turned on.

To manage tamper protection in the Microsoft Defender portal (https://security.microsoft.com), you must have appropriate permissions assigned through roles, such as Global Administrator or Security Administrator. (See Microsoft Defender XDR role-based access control (RBAC).)

• Windows 11
• Windows 11 Enterprise multi-session
• Windows 10 OS 1709, 1803, 1809, or later together with Microsoft Defender for Endpoint.
• Windows 10 Enterprise multi-session

If you're using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. See Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview).

No. Non-Microsoft Antivirus offerings continue to register with the Windows Security application.

If non-Microsoft antivirus/antimalware software is installed on a device, when that device is onboarded to Microsoft Defender for Endpoint, Microsoft Defender Antivirus runs in passive mode by default. Tamper protection protects the service and its features.

If/when non-Microsoft antivirus/antimalware software is uninstalled, Microsoft Defender Antivirus switches to active mode automatically. Tamper protection continues to protect the service and its features.

We recommend using Microsoft Intune to manage Microsoft Defender Antivirus settings for your organization. With Intune, you can control where tamper protection is enabled (or disabled) through policies. You can also protect Microsoft Defender Antivirus exclusions. See Tamper protection: Microsoft Defender Antivirus exclusions.

You can also use the Microsoft Defender portal or Configuration Manager.

If you're a home user, see Manage tamper protection on an individual device.

Tamper protection is part of built-in protection, and should be enabled.

New functionality is rolling out now to protect Microsoft Defender Antivirus exclusions on devices. Certain conditions must be met. For example, you must use Intune only or Configuration Manager only to manage devices, and you must have Sense enabled. See Protect Microsoft Defender Antivirus exclusions.

If you're currently using Intune to configure and manage tamper protection, you should continue using Intune. When tamper protection is turned on and you use Group Policy to make changes to Microsoft Defender Antivirus settings, any settings that are protected by tamper protection are ignored.

• If you must make changes to a device and those changes are blocked by tamper protection, you can use troubleshooting mode to temporarily disable tamper protection on the device. After troubleshooting mode ends, any changes made to tamper-protected settings are reverted to their configured state.
• You can use Intune or Configuration Manager to exclude devices from tamper protection.
• If you're managing tamper protection through Intune and certain other conditions are met, you can manage tamper-protected antivirus exclusions.

If you're using Intune to configure and manage tamper protection, you don't necessarily have to apply tamper protection to your entire organization. With Intune, you can choose to apply tamper protection to your entire organization, or you can select specific devices or user groups to receive tamper protection. You can also exclude specific devices from tamper protection.

When tamper protection is turned on, the following security settings are protected from being changed:

• Virus and threat protection remains enabled.
• Real-time protection remains turned on.
• Behavior monitoring remains turned on.
• Antivirus protection, including IOfficeAntivirus (IOAV) remains enabled.
• Cloud protection remains enabled.
• Security intelligence updates continue to occur.
• Automatic actions are taken on detected threats.
• Notifications are visible in the Windows Security app on Windows devices.
• Archived files are scanned.

For more information, see What happens when tamper protection is turned on?

When tamper protection is turned on in the Microsoft Defender portal (https://security.microsoft.com), tamper protection is turned on, tenant wide. However, policies defined in Intune or Configuration Manager can override settings in the Microsoft Defender portal. For example, you can define a policy in Intune or Configuration Manager that excludes certain devices from tamper protection.

Use Intune to deploy DisableLocalAdminMerge.

Follow the guidance in Manage tamper-protected antivirus exclusions.

No. When tamper protection for exclusions is enabled, you do not need to disable it to apply new exclusions.

Yes. Similar to using Intune, you can apply tamper protection to your whole organization, or to specific users and devices. For more information, see the following resources:

• Manage tamper protection using Intune
• Manage tamper protection using tenant attach with Configuration Manager, version 2006
• Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients

In general, tamper protection helps protect against users being able to change security settings directly on devices. Tamper protection is part of anti-tampering capabilities that include standard protection attack surface reduction rules. To further prevent malware from running in kernel, consider using driver block rules with Application Control for Windows.

If a device is off-boarded from Microsoft Defender for Endpoint, tamper protection is turned on, which is the default state for unmanaged devices.

Alerts should be listed in the Microsoft Defender portal under Alerts.

Your security operations team can also use hunting queries, such as the following example:

AlertInfo|where Title == "Tamper Protection bypass"

You can use any of the following methods to configure tamper protection:

• The Microsoft Defender portal (turn tamper protection on or off, tenant wide)
• Intune (turn tamper protection on or off, and/or configure tamper protection for some or all users)
• Configuration Manager (with tenant attach, you can configure tamper protection for some or all devices by using the Windows Security experience profile).
• Windows Security app (for an individual device used at home or in situations where a security team doesn't manage your device)