Verify Tamper Protection when security settings keep changing

Tamper Protection helps stop other applications from silently changing key Microsoft Defender settings, including real-time and cloud-delivered protection. Microsoft notes that an administrator can still make changes through Windows Security and that Tamper Protection does not control how third-party antivirus registers. If protection switches off unexpectedly, investigate the actual provider and policy before assuming malware or disabling defenses to make a warning vanish.

Before you start​

Record Windows Security's current protection provider, last change and any threat notifications. Update Windows and your approved antivirus. On a managed PC, IT may enforce settings; do not fight that policy with scripts. If you suspect malware, preserve evidence and change important account passwords from a different trusted device.

Do it step by step​

1. Open Windows Security > Virus & threat protection > Manage settings and read the Tamper Protection state. Do not rely on a third-party utility's badge.
2. Check Security providers in Windows Security to see which antivirus is active. Another registered product can change how Defender controls appear without indicating compromise.
3. Review Protection history for alerts, disabled services or repeated changes. Record timestamps and affected settings before modifying them.
4. If Tamper Protection is available and permitted, turn it On in Windows Security. Confirm real-time and cloud-delivered protection are in their intended state.
5. Restart and check again. If the setting reverts, inspect organization policy, third-party security software and Windows updates before using a registry fix.
6. For unexplained repeated changes or a named threat, run an updated scan and consider Defender Offline. Escalate to IT or incident response if administrative controls appear compromised.

Check the result​

The intended antivirus is active, Tamper Protection state is stable after restart and any provider or policy explanation is documented.

If something goes wrong​

If controls are greyed out, identify the managing organization or registered antivirus. If the Windows Security app itself malfunctions, repair it through supported Windows procedures; do not install a random security-center fixer.

Know the limit​

Tamper Protection is one defense layer, not proof that an attacker has no access. It does not replace updates, least-privilege accounts, independent backups or careful review of what users execute. Microsoft virus and threat protection Protection history

Decision checkpoint​

A single setting toggled off once is not the same as a pattern of unauthorized changes. Correlate the change with antivirus installation, a Windows update or an administrator action. If no expected event explains it, investigate startup software and account access. For urgent work, use a clean machine for banking and credential changes while you assess the PC. Avoid piling on multiple antivirus packages; conflicting providers can make the dashboard harder to interpret and protection less reliable.

Aftercare​

For a personal device, keep a dated note of the active security provider, Tamper Protection state and any unexplained change. Recheck after the next restart and protection update. On a managed device, share the observation with IT rather than repeatedly toggling a policy-controlled setting. If the problem persists, preserve the relevant event details for support.