Windows Defender Tamper Protection Registry Key

Windows Defender Tamper Protection is a security feature in Windows 10 and 11 designed to prevent malicious applications and unauthorized users from altering critical antivirus settings. This article identifies the exact Windows Registry (Regedit) key that controls the Tamper Protection engine, explains the associated values, and outlines the behavior and limitations of modifying this key.

The Registry Path and Value

The behavior of the Windows Defender Tamper Protection engine is governed by the following Registry location:

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
• Value Name: TamperProtection
• Value Type: REG_DWORD

Understanding the Value Data

The TamperProtection DWORD value defines the operational state of the feature:

• 0: Tamper Protection is Disabled (Off).
• 5: Tamper Protection is Enabled (On).

(Note: Depending on the specific build of Windows and whether the machine is centrally managed via Microsoft Intune or Defender for Endpoint, other integer values like 1 or 4 may represent intermediate, legacy, or managed states, but 5 is the standard active state on modern standalone systems.)

Important Limitation on Modifying the Key

Because Tamper Protection is explicitly designed to prevent tampering with Defender’s configuration, you cannot modify or delete this registry key while Tamper Protection is active—even when running Regedit as an Administrator.

To make manual changes via the Registry:

1. Open Windows Security.
2. Navigate to Virus & threat protection > Virus & threat protection settings > Manage settings.
3. Toggle Tamper Protection to Off.
4. Once disabled via the user interface, the registry key becomes editable by administrative accounts.