From 6fe75560490053a09545ccb973aaf58ee36969a5 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Fri, 8 Mar 2019 22:23:59 +0000 Subject: [PATCH 1/4] Draft --- ...ecurity-settings-with-tamper-protection.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md new file mode 100644 index 0000000000..4a79a4cae8 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -0,0 +1,39 @@ + + + + +Prevent security settings changes with Tamper Protection + +Tamper Protection helps prevent malicious apps from changing important security settings. These settings include: + +• Real-time protection +• Cloud-delivered protection +• IOfficeAntivirus (IOAV) +• Behavior monitoring +• Scheduled scans +• Policy override settings + +With Tamper Protection set to On, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: + +• Mobile device management (MDM) apps like Intune +• Enterprise configuration management apps like System Center Configuration Manager (SCCM) +• Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures +• Windows System Image Manager (Windows SIM) settings DisableAntiSpyware ad DisableAntiMalware (used in Windows unattended setup) +• Group Policy +• Other Windows Management Instrumentation (WMI) apps + +The Tamper Protection setting doesn't affect how third party antivirus apps register with the Windows Security app. + +On computers running Windows 10 Enterprise E5, users can't change the Tamper Protection setting. + +Tamper Protection is On by default. If you set Tamper Protection to Off, you will see a yellow warning in the Windows Security app under Virus & threat protection. + +Configure Tamper Protection + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Defender. +2. Select Virus & threat protection, then select Virus & threat protection settings. +3. Set Tamper Protection to On or Off. + +Note +If your computer is running Windows 10 Enterprise E5, you can't change the Tamper Protection setting. + From a82e95f29fd3f6c571db912a82298c77061f3d98 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Fri, 8 Mar 2019 22:36:13 +0000 Subject: [PATCH 2/4] Formatting --- ...ecurity-settings-with-tamper-protection.md | 65 ++++++++++++------- 1 file changed, 40 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 4a79a4cae8..66d5e0fe86 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -1,39 +1,54 @@ +--- +title: Prevent security settings changes with Tamper Protection +description: Use tamper protection to prevent malicious apps from changing important security settings. +keywords: malware, defender, antivirus, tamper protection +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: andreabichsel +ms.author: v-anbic +--- +# Prevent security settings changes with tamper protection +**Applies to:** +- Windows 10 -Prevent security settings changes with Tamper Protection +Tamper protection helps prevent malicious apps from changing important security settings. These settings include: -Tamper Protection helps prevent malicious apps from changing important security settings. These settings include: +- Real-time protection +- Cloud-delivered protection +- IOfficeAntivirus (IOAV) +- Behavior monitoring +- Scheduled scans +- Policy override settings -• Real-time protection -• Cloud-delivered protection -• IOfficeAntivirus (IOAV) -• Behavior monitoring -• Scheduled scans -• Policy override settings +With tamper protection set to **On**, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: -With Tamper Protection set to On, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: +- Mobile device management (MDM) apps like Intune +- Enterprise configuration management apps like System Center Configuration Manager (SCCM) +- Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures +- Windows System Image Manager (Windows SIM) settings DisableAntiSpyware ad DisableAntiMalware (used in Windows unattended setup) +- Group Policy +- Other Windows Management Instrumentation (WMI) apps -• Mobile device management (MDM) apps like Intune -• Enterprise configuration management apps like System Center Configuration Manager (SCCM) -• Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures -• Windows System Image Manager (Windows SIM) settings DisableAntiSpyware ad DisableAntiMalware (used in Windows unattended setup) -• Group Policy -• Other Windows Management Instrumentation (WMI) apps +The tamper protection setting doesn't affect how third party antivirus apps register with the Windows Security app. -The Tamper Protection setting doesn't affect how third party antivirus apps register with the Windows Security app. +On computers running Windows 10 Enterprise E5, users can't change the tamper protection setting. -On computers running Windows 10 Enterprise E5, users can't change the Tamper Protection setting. +Tamper protection is On by default. If you set tamper protection to **Off**, you will see a yellow warning in the Windows Security app under **Virus & threat protection**. -Tamper Protection is On by default. If you set Tamper Protection to Off, you will see a yellow warning in the Windows Security app under Virus & threat protection. +##Configure tamper protection -Configure Tamper Protection +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select **Virus & threat protection**, then select **Virus & threat protection settings**. +3. Set **Tamper Protection** to **On** or **Off**. -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Defender. -2. Select Virus & threat protection, then select Virus & threat protection settings. -3. Set Tamper Protection to On or Off. - -Note -If your computer is running Windows 10 Enterprise E5, you can't change the Tamper Protection setting. +>[!NOTE] +>If your computer is running Windows 10 Enterprise E5, you can't change the tamper protection setting. From 8de2be98e03365fe164d7754f582fa992793dfe1 Mon Sep 17 00:00:00 2001 From: "Andrea Bichsel (Aquent LLC)" Date: Fri, 8 Mar 2019 22:37:36 +0000 Subject: [PATCH 3/4] Fixed typo --- ...event-changes-to-security-settings-with-tamper-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 66d5e0fe86..930eb2406a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -33,7 +33,7 @@ With tamper protection set to **On**, you can still change these settings in the - Mobile device management (MDM) apps like Intune - Enterprise configuration management apps like System Center Configuration Manager (SCCM) - Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures -- Windows System Image Manager (Windows SIM) settings DisableAntiSpyware ad DisableAntiMalware (used in Windows unattended setup) +- Windows System Image Manager (Windows SIM) settings DisableAntiSpyware and DisableAntiMalware (used in Windows unattended setup) - Group Policy - Other Windows Management Instrumentation (WMI) apps From 34e77a00035ef4617f6ffee4798cf68c5f311d24 Mon Sep 17 00:00:00 2001 From: martyav Date: Thu, 9 May 2019 11:59:32 -0400 Subject: [PATCH 4/4] corrected list of settings, updated note on E5 --- ...ecurity-settings-with-tamper-protection.md | 32 +++++++++---------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 930eb2406a..16fceaea85 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -20,35 +20,33 @@ ms.author: v-anbic - Windows 10 Tamper protection helps prevent malicious apps from changing important security settings. These settings include: - + - Real-time protection - Cloud-delivered protection - IOfficeAntivirus (IOAV) - Behavior monitoring -- Scheduled scans -- Policy override settings - +- Removing security intelligence updates + With tamper protection set to **On**, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: - + - Mobile device management (MDM) apps like Intune - Enterprise configuration management apps like System Center Configuration Manager (SCCM) - Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures - Windows System Image Manager (Windows SIM) settings DisableAntiSpyware and DisableAntiMalware (used in Windows unattended setup) - Group Policy - Other Windows Management Instrumentation (WMI) apps - + The tamper protection setting doesn't affect how third party antivirus apps register with the Windows Security app. - + On computers running Windows 10 Enterprise E5, users can't change the tamper protection setting. - + Tamper protection is On by default. If you set tamper protection to **Off**, you will see a yellow warning in the Windows Security app under **Virus & threat protection**. - -##Configure tamper protection - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. -2. Select **Virus & threat protection**, then select **Virus & threat protection settings**. -3. Set **Tamper Protection** to **On** or **Off**. - + +## Configure tamper protection + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select **Virus & threat protection**, then select **Virus & threat protection settings**. +3. Set **Tamper Protection** to **On** or **Off**. + >[!NOTE] ->If your computer is running Windows 10 Enterprise E5, you can't change the tamper protection setting. - +>If your computer is running Windows 10 Enterprise E5, you can't change the tamper protection settings from within Windows Security App. \ No newline at end of file