Windows Defender Tamper Protection Registry Key Path

This article provides the exact Windows Registry path used to manage Windows Defender Tamper Protection, outlines the specific values that determine its state, and explains the permissions required to modify these settings.

The Registry Path

The behavior of Tamper Protection in Microsoft Defender Antivirus is controlled by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features

The Specific Value

Inside the Features key, the setting is governed by a DWORD value:

• Value Name: TamperProtection
• Value Type: REG_DWORD
• Value Data:
  • 5 = Tamper Protection is Enabled (Default)
  • 4 or 0 = Tamper Protection is Disabled

Important Modification Requirements

Because Tamper Protection is designed to prevent malicious software and unauthorized users from altering security settings, you cannot simply open Regedit and change this value under normal operating conditions. The Features key is protected by Windows operating system permissions (owned by TrustedInstaller / SYSTEM).

To modify this value via the registry: 1. You must disable Tamper Protection first via the Windows Security app interface (Windows Security > Virus & threat protection > Virus & threat protection settings > Tamper Protection). 2. Alternatively, the machine must be booted into Safe Mode or accessed via an elevated environment (such as WinPE or using SYSTEM-level tools like PsExec) to modify the key directly.