Learn about Tamper Protection, the new security feature on Windows 10

Microsoft has announced that the Windows 10 Tamper Protection security feature is now officially available to businesses and individual users. Along with this notice, Microsoft will turn on this security feature on all Windows 10 devices by default.

Tamper Protection is a security feature introduced in Windows 10 version 1903, also known as May 2019 Update (May 2019 update). When enabled, Tamper Protection prevents the installation of Windows Security and Windows Defender from being altered by Windows command-line programs, tools, Registry changes, or group policies.

Instead, users must modify their security settings directly through the Windows 10 user interface or through Microsoft's enterprise management software like Intune.

If Tamper Protection is not currently enabled on your Windows 10 device, the good news is that Microsoft says it will implement this change for all Windows 10 users. However, it may take a few days before it gets available. Turn on automatically for everyone.

If you don't want to wait, you can enable it now, by following the instructions in this article: How to turn on Tamper Protection for Windows Security on Windows 10 from TipsMake.com.

Tamper Protection is an important tool to prevent security breaches

With Windows Defender becoming a reliable antivirus solution and further enhanced security enhancements added to Windows 10, malware is increasingly struggling to overcome them.

This is done by trying to turn off or impair the functionality of Windows Defender through PowerShell commands, group policies, or modify the Registry.

For example, over the past 4 months, we have seen TrickBot, GootKit and Nodersok Trojans make a concerted effort to defeat Windows Defender, to gain the right to stay on the infected computer or to bypass protections.

However, when Tamper Protection is turned on, these attempts to change Windows Defender or Windows Security settings will be ignored or simply reset.

Because Windows Defender automatically turns on when third-party antivirus software is removed, it is even more important to have Tamper Protection turned on so that Windows Defender can fully protect you.

Individual users use Windows Security settings

For consumers, Tamper Protection is set in the Virus & Threat Protection settings of Windows Security.

To access this section, you'll open the Windows 10 installation, click on Windows Security , then Virus & Threat Protection , then select Manage Settings under Virus and Threat protection settings .

Scroll down and you will see an option titled Tamper Protection as shown in the image below.

Enterprises use Intune to manage Tamper Protection

Although enterprise workstations can enable Tamper Protection using the same method as normal users, administrators can also manage it using Microsoft Intune management software.

Using Intune, an organization can enable Tamper protection for the entire system, by device type or even user groups as shown below.

When enabled via enterprise software, workstations will show that this setting is being managed by the admin.

To provide additional security for the management of Tamper Protection, each time the Tamper Protection settings change is made by Intune, the request is digitally signed.

When a client receives this request, it will confirm that the signature is legal and if not, ignore the changes. You can see an illustration of how these signed requests are given by Intune below.

When an attacker, whether it's a malware or a local user, tries to forge the installation of Windows Security or Windows Defender, an alert will be sent to the Microsoft Defender Security Center. Administrators can then drill down into these alerts to see which machines are being targeted and take corrective actions.

With malware actively targeting Tamper Protection, this feature is not only important, but is also required to be enabled to provide comprehensive protection for Windows 10 users.

All users, whether individual or business users, need to make sure Tamper Protection is enabled.