Forum Discussion
Change tamper protected settings permanently
Hi there, I need to disable real-time monitoring permanently on a device. I can turn it off temporarily using troubleshooting mode but once tamper protection is back on, so is real-time monitoring. ...
To my knowledge, you have to create a new AV policy with "local admin merge" disabled and enforce it on this scoped device only. Once done, then you can disable RTP with below PS command..
Set-MPPreference -DisableTamperProtection $true
Woah okay I haven't heard of this before! Do you think it can be done on group policy or the defender portal? Thanks for replying still
No, per Microsoft tamper protection cannot be disabled through GPO. Here's the reference.
https://learn.microsoft.com/en-us/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus#are-you-using-group-policy