How to Turn Off Tamper Protection in Windows Security Safely

To turn off Microsoft Defender Tamper Protection, open Windows Security, go to Virus & threat protection > Manage settings, and switch Tamper Protection to Off. You need administrator permission, and an organization policy or another antivirus product may prevent the change. Disable it only for a specific, trusted task, then turn it back on immediately; Tamper Protection is separate from Real-time protection, which can remain active.

Before you turn Tamper Protection off, check whether you actually need to

Tamper Protection prevents apps and users from changing important Microsoft Defender settings, including security features that malware may try to disable. Turn it off only when a legitimate, trusted software change or troubleshooting procedure specifically requires it. Do not disable it because an app, download, pop-up, or unofficial instruction tells you to.

Before starting, make sure you have:

• A supported Windows 10 or Windows 11 installation with the Windows Security app available.
• An administrator account, or administrator credentials needed to approve the change.
• A clear reason for changing the setting and a specific task to perform afterward.
• Software obtained from a source you trust, with its installer or change ready before protection is reduced.
• A plan to turn Tamper Protection back on as soon as the task is complete.

Keep internet exposure and other changes to a minimum while the setting is off. Do not browse unfamiliar sites, open unexpected attachments, or install unrelated software during that period. If the task concerns a file that Defender detects, verify the file's source and intended behavior before treating the detection as an obstacle.

Where to find Tamper Protection in Windows Security

On current Windows 11 and Windows 10 systems, Tamper Protection is under Virus & threat protection settings in Windows Security. The labels are substantially the same, although the layout can vary slightly by Windows update.

1. Open the Start menu, type Windows Security, and open the app.
2. Select Virus & threat protection. The Virus & threat protection page opens.
3. Under Virus & threat protection settings, select Manage settings.
4. Find Tamper Protection in the list. Its status normally shows On or Off.

On Windows 11, you can also open Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings.

On Windows 10, open Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings.

If Windows Security is missing, will not open, or shows incomplete protection information, resolve that issue before changing the setting. A damaged Windows Security interface, another antivirus product, or device management policy can prevent the control from appearing.

Switch Tamper Protection off without disabling more protection than necessary

On the Virus & threat protection settings page, change only the Tamper Protection control unless your documented troubleshooting procedure requires another Defender setting. Tamper Protection, Real-time protection, cloud-delivered protection, and automatic sample submission are separate controls.

1. In Virus & threat protection settings, locate Tamper Protection.
2. Select the On toggle next to Tamper Protection.
3. Approve the User Account Control prompt if Windows displays one. Enter administrator credentials if requested.
4. Confirm that the control now shows Off.
5. Perform only the trusted installation, configuration change, or diagnostic step that required the setting to be disabled.

Real-time protection may still be on after Tamper Protection is disabled. That is usually preferable because Defender continues its ordinary file and process monitoring while you make the specific configuration change. If your software vendor or troubleshooting procedure separately requires Real-time protection to be off, treat that as a separate change and restore it immediately afterward. Leave cloud-delivered protection, automatic sample submission, and other safeguards enabled unless the exact task requires otherwise.

Do not leave Tamper Protection off while experimenting with unknown software or altering unrelated security settings. The longer it remains disabled, the more opportunity there is for unwanted changes to persist.

How to confirm the change and turn it back on

Windows Security should show Tamper Protection as Off immediately after the change. Use that status as confirmation before proceeding. A notification or User Account Control prompt alone does not prove that the change remained in effect.

1. Return to Windows Security > Virus & threat protection > Manage settings.
2. Check that Tamper Protection shows Off while the approved task is in progress.
3. Finish the installation or troubleshooting change, then close the installer or diagnostic tool.
4. Select the Off toggle beside Tamper Protection.
5. Approve the User Account Control prompt if it appears, and confirm that the status changes to On.
6. If you also changed Real-time protection or another Defender setting, restore each setting separately and confirm its status.
7. Run a Windows Security scan if the task involved installing, replacing, or modifying executable files. Restart Windows if the software change requires it or if Defender reports that a restart is needed.

The completion check is the settings page itself: Tamper Protection and any other temporarily changed Defender controls should show On after the task. If Tamper Protection turns itself back on before you finish, a management policy or security component may be enforcing the setting. Do not repeatedly fight the control without identifying what manages the device.

Why the toggle is greyed out or keeps turning back on

A disabled or unavailable Tamper Protection control usually means local Windows Security is not the authority making the decision. Check these common causes.

• Organization management: A work or school device may receive Microsoft Intune, Group Policy, or Microsoft Defender for Endpoint settings. Administrators can block local changes or enforce Tamper Protection, and the setting may return to its managed value after you change it.
• Third-party antivirus software: Another antivirus product may be the active security provider. It can change which Defender features are available, and its own policy may control protection settings.
• Insufficient permissions: A standard account cannot make some security changes. Sign in with an administrator account or have an authorized administrator approve the action.
• Security policy enforcement: Microsoft Defender for Endpoint or another management system can automatically restore protection settings. This is expected behavior, not a Windows Security failure.
• Windows Security problems: Pending updates, a damaged security app, or disabled Defender-related services can make the page incomplete or unresponsive.

If the computer belongs to an employer, school, or other organization, contact its administrator instead of trying registry edits, scripts, or unofficial utilities. On a personal PC, confirm which antivirus product is active and update Windows before troubleshooting the Windows Security app. Never use a workaround to defeat a policy you do not own or administer.

Conclusion

Use Tamper Protection as a short-lived exception, not as a routine installation step. Prepare the trusted software first, disable only the setting the task requires, and return to Virus & threat protection settings as soon as the task ends. Confirm that Tamper Protection and any other temporarily changed Defender controls show `On`, then scan or restart when appropriate. If Windows will not let you change the setting, identify the active antivirus or management policy instead of forcing a local override.

Frequently Asked Questions

Does turning off Tamper Protection turn off Microsoft Defender?

No. Tamper Protection controls whether important Defender settings can be changed. Real-time protection and other Defender features may remain enabled, and each has a separate control.

Why does Windows ask for administrator approval?

Tamper Protection changes a system-wide security setting. Windows requires administrator permission or administrator credentials before it accepts the change.

Can I turn off Tamper Protection permanently?

You can usually leave the toggle off on an unmanaged personal device, but you should not. It reduces Defender's resistance to unwanted configuration changes. Restore it immediately after the specific task that required it.