The first thing sophisticated malware does on a new PC is not steal or encrypt - it tries to blind the guard. Defender is on almost every Windows PC, so it is target number one. Tamper Protection is the lock on the guard's own controls.
There is a simple reason attackers study Defender so closely: it is everywhere. Malware that can disable or weaken it gains a free field on nearly any Windows machine it lands on. So modern attacks carry a standard early move - turn off real-time protection, add an exclusion folder, or stop the service - attempted through scripts, registry edits and management interfaces. Tamper Protection exists precisely to refuse those changes when they come from outside the Windows Security app. This page explains what it blocks, what it does not, and the two-minute check that proves yours is on.
The attempts are boringly standard, because they so often worked in the past. A script tries to set the registry values that disable real-time monitoring. A command tries to add the malware's own folder to the exclusions list, so the engine agrees never to look there. A tool tries to stop the Defender service or mark a malicious file as trusted. Older Windows versions allowed much of this to any program running with administrator rights - and since users so often browse and install as administrator, the malware had those rights. The attacker's logic is sound: why fight the engine when you can ask Windows to switch it off?
Tamper Protection, on by default for home users on current Windows 10 and 11, moves the controls behind a lock. Changes to Defender's core settings - real-time protection behaviour, cloud protection, sample submission, and the engine's own service settings - are accepted only from inside the Windows Security app, by the person sitting at the PC. The same change attempted by a script, a registry edit, PowerShell, or a third-party 'optimizer' is simply refused. Attackers know this, which is why current malware families increasingly try social routes instead: fake warnings and pop-ups that trick you into opening the app and switching things off yourself. Tamper Protection cannot refuse you - which is why the human layer still matters.
Open Windows Security, then Virus & threat protection, then Manage settings under Virus & threat protection settings. Scroll to Tamper Protection and confirm it is On. While you are on that screen, also confirm Real-time protection and Cloud-delivered protection are On. Then open Exclusions on the same page and read the list with your own eyes - it should be empty, or contain only entries you deliberately added and can explain. Technicians can verify from PowerShell: Get-MpComputerStatus shows a tamper-protection status field for the machine. If Tamper Protection is off and you do not remember turning it off, treat that seriously - something already visited your settings.
The commonest self-inflicted wound is not malware at all - it is a tutorial. 'Fix' guides for game cracks, activators and random errors routinely tell users to add whole drives or download folders to Defender's exclusions, or to switch real-time protection off 'temporarily'. A folder exclusion is a permanent hole exactly where risky files live, and temporary switches are forgotten. The rule is simple: never exclude a folder to make a warning go away. A warning is information. If a legitimate program and Defender truly cannot coexist, the answer is an exception for that one program file, added knowingly - and even then, note it down and review it monthly.
Honest limits: Tamper Protection guards Defender's settings; it is not itself an antivirus, a firewall or a backup. It does not stop malware that runs before Windows loads, it does not help if you personally approve a malicious installer inside the app, and on office PCs it should be managed centrally by policy rather than left to each user. It also was not present in old Windows versions, which is one more reason an unpatched, out-of-support system cannot be made safe by any setting. Keep it on, keep the exclusions list empty, and let it do its one job: making sure the guard cannot be quietly dismissed by the intruder.
See the full argument on screen - what Defender covers, what it does not, and what to add around it.
▶️ Watch Full VideoYes - on current Windows 10 and Windows 11 home PCs, Tamper Protection is enabled by default. You can confirm it under Windows Security, Virus & threat protection, Manage settings. If you find it off and never turned it off yourself, run a full scan and review your exclusions, because something changed your settings.
Not through the usual script, registry or command routes - Tamper Protection accepts core setting changes only from inside the Windows Security app. That is why modern malware tries to trick the user into switching things off manually, using fake warnings. The lock stops programs, not people, which is why user caution remains a real layer.
No. A folder exclusion tells Defender never to scan that folder, which is exactly where risky files are most likely to land. It is the commonest self-inflicted security hole, often added while following a crack or fix tutorial. If a warning appears, read it instead of excluding your way around it.