Key Points
- Tamper protection stops malicious apps and other users from changing protected Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection.
- Tamper protection is turned on by default in Windows 10, and you can check or change it in Windows Security under Virus & threat protection settings on Windows 10 and Windows 11 devices that your security team doesn’t manage centrally.
- Tamper protection should be turned off only briefly for a task that needs a protected setting changed, then turned back on.
- Tamper protection can be configured across many devices with Microsoft Intune, or the Microsoft Defender portal, so IT teams do not need to change each device.
Protecting your devices from malicious software helps prevent data breaches and minimizes business disruptions. Protection that’s built into your device, like tamper protection for Windows 10, provides an additional layer of security to safeguard your endpoints.
Microsoft ended support for Windows 10 on October 14, 2025. Windows devices now receive security updates only through Microsoft’s Extended Security Updates (ESU) program, so plan your move to Windows 11 and keep tamper protection on until you get there.
Prefer a visual guide? Watch the video version of this blog: Enabling & Disabling Tamper Protection for Windows 10.4
Enforce and mandate tamper protection for your Windows endpoints with NinjaOne, a comprehensive RMM solution that streamlines security management.
Learn more about NinjaOne Endpoint Management
How to toggle protection
Tamper protection for Windows 10 is enabled by default, but an administrator may disable it at any point. To enable or disable it, follow the step-by-step instructions below:
- Open the Windows Security app by clicking on the Start menu and typing “Windows Security.”
- Select “Windows Security” from the search results to open the app.
- In the Windows Security app, click on the “Virus & threat protection” tab.
- Under the “Virus & threat protection settings,” click on “Manage settings.”
- Scroll down to the “Tamper Protection” section and toggle the switch to your preference.
When enabled, tamper protection will provide an additional layer of security. Turning it off will allow you to perform tasks that are otherwise restricted when tamper protection is enabled. Keep in mind that it is generally a good practice to re-enable tamper protection once you have finished tasks that require it to be turned off.
What is tamper protection?
Part of Windows Security, tamper protection for Windows 11 and 10 helps protect your system against unauthorized changes and modifications by preventing malicious software or users from tampering with critical system settings, files, and processes. Enabling tamper protection adds extra security to your system, making it more resistant to attacks and unauthorized access.
The importance of tamper protection for Windows system security
Tamper protection helps keep malicious apps from turning off or changing protected Microsoft Defender Antivirus settings, including real-time protection and cloud-delivered protection. It does not stop an administrator from changing these settings in Windows Security, so the setting stays under IT control.
Should I turn off tamper protection in Windows?
While tamper protection is an important security feature, there are times when you need to disable it temporarily. For example, you’ll need to disable tamper protection for Windows 10 when installing or updating third-party security software, troubleshooting or changing security settings, or uninstalling security components.
Turn off tamper protection only when a task requires changing a protected setting, such as troubleshooting a security configuration or changing Microsoft Defender Antivirus settings manually. Turn it back on as soon as the task is done.
Manage tamper protection across many devices with Microsoft Intune
IT teams that manage many Windows devices can configure tamper protection centrally with Microsoft Intune instead of changing the setting on each device. Intune applies the setting through a Windows Security Experience device configuration profile. Many organizations run Microsoft Intune alongside NinjaOne. See how NinjaOne works with Microsoft Intune
NinjaOne integrates with robust endpoint security tools. This, along with tamper protection helps strengthen your endpoints’ security posture.
Manage all of your endpoints with ease
Tamper protection in Windows systems protects not only your Windows Security features and settings but also helps you maintain consistent security configurations in a large IT environment. The most efficient way to manage tamper protection across all your devices is with an endpoint management tool that allows you to monitor and secure all devices in your organization, including desktop computers, laptops, smartphones and tablets.
A comprehensive endpoint management solution like NinjaOne provides advanced endpoint management capabilities, allowing you to centrally manage, secure and monitor all your devices from a single platform.
With NinjaOne, you can ensure that all your endpoints are up-to-date with the latest security patches, have the necessary antivirus protection and adhere to your organization’s security policies. NinjaOne also helps you manage your antivirus solution, with granular control over schedules and scans, encrypt your endpoint drives, back up device data and prevent remote attacks by identifying and removing rogue endpoints.
NinjaOne’s endpoint management solution helps increase security and efficiency in managing your organization’s endpoints. Ready to take your endpoint management to the next level? Experience increased security and efficiency with NinjaOne’s comprehensive endpoint management solution. Learn more about how you can increase security with NinjaOne’s endpoint management today.
