Modify Tamper-Protected Settings in Windows

Tamper Protection in Windows prevents unauthorized applications, malware, and direct registry edits from altering critical security configurations, particularly those governing Microsoft Defender Antivirus. Attempting to modify these keys directly via the Registry Editor (regedit.exe) results in access denied errors even when running as an elevated Administrator or SYSTEM. To legitimately modify these protected settings without encountering access denials, administrators must use official management interfaces, cloud policies, or temporarily disable Tamper Protection through supported administrative channels.

1. Temporarily Disable Tamper Protection Locally

For standalone or unmanaged devices, an administrator can disable the feature through the graphical user interface before making configuration changes:

  1. Open the Start Menu and search for Windows Security.
  2. Navigate to Virus & threat protection.
  3. Under Virus & threat protection settings, click Manage settings.
  4. Scroll down to Tamper Protection and toggle the switch to Off (confirm the User Account Control prompt).
  5. Open regedit and apply the required configuration modifications.
  6. Return to the Windows Security panel and toggle Tamper Protection back to On to restore system defense.

2. Configure Settings via Microsoft Intune

In enterprise environments managed by Microsoft Intune, direct registry modifications should be avoided in favor of centralized device configuration profiles:

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Endpoint security > Antivirus.
  3. Select an existing policy or create a new Windows Security Experience profile.
  4. Adjust the target Defender settings or configure the Tamper Protection state directly within the profile.
  5. Assign the policy to the target device group to propagate the changes automatically without triggering client-side registry blocks.

3. Manage via Microsoft Defender for Endpoint

For organizations utilizing Microsoft Defender for Endpoint without Intune management:

  1. Access the Microsoft Defender portal (security.microsoft.com).
  2. Navigate to Settings > Endpoints > Advanced features.
  3. Manage enterprise-wide Tamper Protection policies or configure exclusions through the portal.
  4. Security configurations pushed from the portal bypass local tamper enforcement because they are validated through secure management channels.

4. Safe Mode for Recovery Scenarios

If registry changes must be made for troubleshooting or disaster recovery on an unbootable or misconfigured system, boot the machine into Safe Mode. In Safe Mode, the Microsoft Defender Antivirus services and Tamper Protection drivers do not load, allowing local administrators with full control permissions to modify the necessary registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender. Once modified, reboot the system into normal mode.