Every Defender removal attempt starts with the same obstacle, and it is there on purpose. Tamper Protection is the guard that refuses to let programs - including you, via a script - quietly disarm the antivirus.
"I changed the setting and it changed back." "The tool says Tamper Protection is blocking it." Behind both reports sits one feature, on by default since 2019, and widely misunderstood as Microsoft being difficult. Tamper Protection exists because real malware's first move, for years, was to switch the antivirus off - using the very same registry values and service controls that tweak tools use. This page explains what it guards, how it decides whom to trust, and what the legitimate paths for changing Defender settings look like.
Tamper Protection locks the Defender settings that matter most to an attacker: real-time protection, behaviour monitoring, cloud-delivered protection, automatic sample submission, and protections around controlled folder access and the antivirus's own services and drivers. While it is on, those settings can only be changed through the Windows Security app itself, or by a recognised management system such as Intune or properly applied Group Policy.
Changes attempted any other way - registry value edits, PowerShell preference commands from an unprivileged context, service control tricks, third-party "defender control" utilities - are ignored or reverted. That is not a malfunction. It is the feature performing exactly the task on its label.
If it is off and you did not turn it off, stop and think: something with administrator rights changed a security control on your PC. Run a full scan after turning it back on. On a work PC it may be managed by your organisation, in which case the page will say so and the toggle is not yours to move.
Read any remover tool's instructions and step one is always the same: disable Tamper Protection manually, inside the app, because the tool cannot. That instruction is the most honest part of the whole procedure - it is an admission that the tool needs you to dismiss the guard before it can work.
Pause on what that means. A program whose first requirement is that you personally unlock the security settings, so it can then do things Windows normally forbids, is asking for the exact sequence of events Tamper Protection was built to prevent. In the lab context there are legitimate reasons; on your main PC, that request alone should end the discussion.
Tamper Protection is not a wall around Defender - it is a door policy. Three doors exist. You, interactively, in the Windows Security app: pause real-time protection, add an exclusion, toggle a setting. Your organisation's management, through Intune or Group Policy, where an admin is accountable for the change. And a registered antivirus taking over, where Windows itself moves Defender aside through the Security Center mechanism. Everything this guide set recommends travels through one of those doors. If a method requires a fourth door - a script sneaking past the guard - it is not a method, it is tampering, by the feature's own definition.
There are narrow moments where an admin intentionally turns Tamper Protection off inside the app - troubleshooting a managed setting, or preparing a lab image - and then turns it back on. The rules are simple: only from inside Windows Security, only for the duration of the specific job, only on a machine whose context you fully control, and back on immediately after. Leaving it off "for convenience" removes the lock from every Defender setting at once, permanently, including against the malware the lock was built for. Convenience is the most expensive reason to keep a guard dismissed.
Watch the video and notice the role Tamper Protection plays - this page explains the guard it has to get past.
▶️ Watch Full VideoBecause Tamper Protection ignores Defender setting changes made outside the Windows Security app or a management tool. Values like DisableAntiSpyware are also deprecated on modern consumer Windows and are ignored even apart from Tamper Protection. The setting was not broken; it was refused, by design.
Turning it off removes the lock from all of Defender's critical settings at once, so any program with administrator rights - including malware - can then change them. Briefly, inside the app, for a specific admin task on a machine you control is the accepted pattern. Leaving it off permanently on a daily-use PC is a standing invitation and should never be the end state.
No, and you should not try. On organisation-managed devices the setting belongs to your IT team, who control it through Intune or Group Policy. If Defender is interfering with your work there, the route is a helpdesk ticket for an exclusion or policy change - local removal tools on a managed machine are treated as tampering.