How to Enable Tamper Protection in Windows 11
Tamper Protection in Windows 11 stops malicious apps from turning off Microsoft Defender and changing your antivirus settings. It locks your core security features so unauthorized programs cannot disable real-time protection, cloud-delivered protection, or file exclusions.
You turn it on or off in the Windows Security app. That keeps your PC safe from threats that try to quietly switch off your defenses before they do any damage. Windows 11 enables the setting by default on most home PCs, but it is worth checking, because some malware, cleanup tools and “tweak” utilities try to change it. This guide shows where to find the switch, how to turn it on, and what to do if it is greyed out.
Open Windows Security from the taskbar search, go to Virus & threat protection, click Manage settings, then scroll down and switch Tamper Protection to On. You need an administrator account, and the change takes effect immediately with no restart. If the switch is greyed out, your organisation’s IT department is managing it.
Why use Tamper Protection?
Malicious software often tries to turn off your antivirus so it can hide and spread. Tamper Protection acts like a lock on Microsoft Defender Antivirus. Only you, acting as the administrator through the Windows Security app, can change these important settings. Windows 11 turns the feature on by default, so a fresh install or a new PC is usually protected from the start.
The feature is available on every edition of Windows 11, Home and Pro included. You do not need a special license to use it.
What happens when done?
Once enabled, your antivirus settings are locked. Even if a malicious app tries to change them using Registry Editor, Windows commands or PowerShell, or Local Group Policy, the system blocks the attempt. This prevents unauthorized security changes that could leave your PC vulnerable.
The protection covers the settings that matter most, such as real-time protection, cloud-delivered protection and your exclusion lists. The settings still work normally when you change them yourself in the Windows Security app.
How to change Tamper Protection settings
Open the app from the taskbar search, go to Virus & threat protection, click Manage settings, and scroll down to the Tamper Protection switch. You need to be signed in with an administrator account to flip it.
The four steps below walk through it. No restart is normally needed, and the change takes effect right away.
- Click the search box on your taskbar and type Windows Security. Select it from the list. The Windows Security window opens. You can also get there from Settings Privacy & security Windows Security, then click Open Windows Security.
- Click on Virus & threat protection in the left sidebar. The page that opens shows your current threats, the last scan, and your protection settings.
- Under the Virus & threat protection settings section, click Manage settings. You may need to scroll down a little to see it. A list of switches appears, including Real-time protection and Cloud-delivered protection.
- Scroll down the list and use the switch to turn Tamper Protection to On or Off. If a User Account Control prompt appears, click Yes. The switch then shows the new state. To undo a change, come back to this page and flip the switch again.
If you do turn it off, switch it back on as soon as you are done. While it is off, any app running on your PC could change your Defender settings.
Enterprise and Advanced Management
In workplaces, IT administrators can manage Tamper Protection using tools like Microsoft Intune (a mobile device management and application management service) or Group Policy (settings for managing groups of computers). When a policy controls the setting, it overrides what you choose in the Windows Security app on that PC.
Troubleshooting Common Errors
If your Tamper Protection settings are greyed out in Windows 11, it typically means your company's IT department controls them. Look for a message such as "Some settings are managed by your organization" in the Windows Security app. On a work or school PC, ask your IT team to change the setting. On a personal PC, a greyed-out switch can also mean another antivirus program is running and Microsoft Defender is not the active protection, so check which security product is in use.
Can I disable Tamper Protection if I am an administrator?
Yes, as an administrator, you can toggle the switch in the Windows Security app. However, if your device is managed by an organization through Microsoft Intune or Group Policy, the option may be greyed out, requiring you to contact your IT department to change the configuration.
Summary
Tamper Protection is a vital layer of defense in Windows 11. It prevents unauthorized apps from disabling your antivirus. By keeping this feature active, you protect your system from malicious changes. You can manage this setting through the Windows Security app, or through enterprise tools like Microsoft Intune. If the switch is off on your personal PC, turn it back on in Windows Security Virus & threat protection Manage settings
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
The procedure you described above is easy but doesn’t allow me to turn it on anyways. Something is wrong, I have to remove McAfee apps from a download that another application did install without me noticing it. However, I can’t turn it on the Tamper Protection.
Do you have any other suggestions on what to do?