Windows 10: Microsoft enables Tamper Protection on Windows 10 for all Home users

GHacks · Oct 14, 2019

Microsoft unveiled a new security feature called Tamper Protection for the company's Windows Defender Antivirus solution in December 2018.

Tamper Protection, as the name suggests, protects certain security features from tampering. One of the barriers that Tamper Protection puts in place around security features blocks manipulations of setting changes that are made outside of the official Settings application.

Attackers may attempt to disable real-time protections or certain security features and Tamper Protection was designed to prevent these changes from being made successfully.

Microsoft did not reveal much about the feature when it launched it in December 2018 but a new blog post on the official Tech Community website provides additional insight and the news that the security feature is being rolled out to all Home installations of Windows 10 that run the current feature update version Windows 10 version 1903.

Previously, Tamper Protection was only available for business customers but Microsoft decided to enable it by default on all Home systems as well.

Tamper Protection helps against manipulation of the operating system's real-time protection, cloud-delivered protection, the detection of suspicious Internet files, behavior monitoring, and security intelligence updates among other things according to Microsoft.

Enterprise customers may configure Tamper Protection through Microsoft Intune; Home users find the option in the Windows Security application on their devices.

Microsoft notes that the feature is being rolled out to systems over time; some users may see the new option already, others may not see it yet.

Tamper Protection configuration

Here is how you enable or disable the new feature on Windows 10 home devices:

Make sure that the operating system version is Windows 10 version 1903 or newer.

Use the keyboard shortcut Windows-I to open the Settings application.

Select Update & Security > Windows Security.

Activate the "open Windows Security" button with a click.

Select Virus & threat protection settings.

Tamper Protection is listed on the page. Just toggle the feature on or off using the slider.

Tip: You may also enable the feature in the Registry. Open the Registry Editor on the system and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features. Locate the TamperProtection setting there and set it to 0 (off) or 1 (on). Note that you need to restart the system or log off and on again before the change takes effect.

Microsoft revealed plans to improve the Tamper Protection feature in the future and bring it to older versions of the Windows 10 operating system as well.

Now You: Is Tamper Protection a useful security feature? What's your take on it? (via Deskmodder)

Thank you for being a Ghacks reader. The post Microsoft enables Tamper Protection on Windows 10 for all Home users appeared first on gHacks Technology News.

read more...

Brink · Oct 14, 2019

New Tamper protection in Microsoft Defender ATP for Windows 10

We are committed to making our solutions resistant to attacks and continuously working towards raising the bar in security. In this blog we’re covering a key feature of our tampering protection strategies, which build on our previously announced Windows Defender Antivirus sandboxing capability.

Tamper protection is a new setting available in the Windows Security app which provides additional protections against changes to key security features, including limiting changes that are not made directly through the app.

If you are a home user, you can toggle the setting from the Virus & threat protection settings area in the app. For enterprise environments, the setting can be managed centrally through the Intune management portal.

We’re continuing to work on the feature, but the current version of the setting is available to Windows Insiders today. The full functionality of the feature (including support for enterprise-level management) will be released along with the upcoming release of Windows 10.

Enabling this feature prevents others (including malicious apps) from changing important protection features such as:

Real-time protection, which is the core antimalware scanning feature of Microsoft Defender ATP next gen protection and should rarely, if ever, be disabled

Cloud-delivered protection, which uses our cloud-based detection and prevention services to block never-before seen malware within seconds

IOAV, which handles the detection of suspicious files from the Internet

Behavior monitoring, which works with real-time protection to analyze and determine if active processes are behaving in a suspicious or malicious way and blocks them

The feature also prevents the deletion of security intelligence updates and the disabling of the entire antimalware solution.

For Windows home users, the feature will be On by default when Windows is installed. If you are upgrading and Cloud-delivered protection is enabled, then the tampering protection feature will also be turned On.

For enterprise customers (such as those with a Microsoft Defender ATP license), this feature will be opt-in and can only be managed from the Intune management console. Local device admin users will not be able to change the setting. This ensures that even malicious apps – or malicious actors – can’t locally override the setting. Note that enterprise management is not available in current preview versions of Windows 10, but we’ll be bringing it to preview shortly.

Now in limited preview

We’re continuing to work on this feature, and you can test it out now on any recent Windows Insider build released during March 2019 or later. If you’d like to test this feature, please send us feedback via the Feedback Hub, or email us at L: [email protected].

We’d love to have you on the journey so we can use your feedback and insights to deliver strong protection across platforms.

Not yet reaping the benefits of Microsoft Defender ATP’s industry-leading optics and detection capabilities? Sign up for free trial today.
Click to expand...

Source: Tamper protection in Microsoft Defender ATP - Microsoft Tech Community - 389571

Tip How to Turn On or Off Tamper Protection for Windows Defender Antivirus in Windows 10

Brink · Oct 14, 2019

New Tamper protection in Microsoft Defender ATP for Windows 10

We are committed to making our solutions resistant to attacks and continuously working towards raising the bar in security. In this blog we’re covering a key feature of our tampering protection strategies, which build on our previously announced Windows Defender Antivirus sandboxing capability.

Tamper protection is a new setting available in the Windows Security app which provides additional protections against changes to key security features, including limiting changes that are not made directly through the app.

If you are a home user, you can toggle the setting from the Virus & threat protection settings area in the app. For enterprise environments, the setting can be managed centrally through the Intune management portal.

We’re continuing to work on the feature, but the current version of the setting is available to Windows Insiders today. The full functionality of the feature (including support for enterprise-level management) will be released along with the upcoming release of Windows 10.

Enabling this feature prevents others (including malicious apps) from changing important protection features such as:

Real-time protection, which is the core antimalware scanning feature of Microsoft Defender ATP next gen protection and should rarely, if ever, be disabled

Cloud-delivered protection, which uses our cloud-based detection and prevention services to block never-before seen malware within seconds

IOAV, which handles the detection of suspicious files from the Internet

Behavior monitoring, which works with real-time protection to analyze and determine if active processes are behaving in a suspicious or malicious way and blocks them

The feature also prevents the deletion of security intelligence updates and the disabling of the entire antimalware solution.

For Windows home users, the feature will be On by default when Windows is installed. If you are upgrading and Cloud-delivered protection is enabled, then the tampering protection feature will also be turned On.

For enterprise customers (such as those with a Microsoft Defender ATP license), this feature will be opt-in and can only be managed from the Intune management console. Local device admin users will not be able to change the setting. This ensures that even malicious apps – or malicious actors – can’t locally override the setting. Note that enterprise management is not available in current preview versions of Windows 10, but we’ll be bringing it to preview shortly.

Now in limited preview

We’re continuing to work on this feature, and you can test it out now on any recent Windows Insider build released during March 2019 or later. If you’d like to test this feature, please send us feedback via the Feedback Hub, or email us at L: wdcustomer@microsoft.com.

We’d love to have you on the journey so we can use your feedback and insights to deliver strong protection across platforms.

Not yet reaping the benefits of Microsoft Defender ATP’s industry-leading optics and detection capabilities? Sign up for free trial today.
Click to expand...

Source: Tamper protection in Microsoft Defender ATP - Microsoft Tech Community - 389571

Tip How to Turn On or Off Tamper Protection for Windows Defender Antivirus in Windows 10

coch · Oct 14, 2019

Defender Tamper Protection/1903

For me, Tamper protection consistently turns off when installing Windows Defender updates (KB2267602). Immediately after updating if you check tamper protection it is off, when it was on before.

I thought perhaps the update required a reboot (even if it didn't warn me of this) to re-enable Tamper protection, so I rebooted to test it out, but it was still off after reboot

This happens whether I use offline updates downloaded from Microsoft, or automatic updates from Windows Updates.

Win10 1903 x64
Click to expand...

I take back my words, it is specifically KB4052623 which turns Tamper protection mode off, not KB2267602. I got things mixed up because both KB2267602 and KB4052623 are typically offered as Windows Defender updates on a fresh install of Win10 1903. But installing those updates sequentially, I found that only KB4052623 shuts off the Tamper protection mode, and the only way to turn it back on is manually. It doesn't turn back on upon rebooting.

Tamper protection mode does stay on after switching it on manually, but I still think that Windows 10 updating itself should keep this setting on after an update if it was on before the update, and this should be automatic, without user input.

Windows 10: Microsoft enables Tamper Protection on Windows 10 for all Home users

Microsoft enables Tamper Protection on Windows 10 for all Home users

Microsoft enables Tamper Protection on Windows 10 for all Home users

Microsoft enables Tamper Protection on Windows 10 for all Home users

Microsoft enables Tamper Protection on Windows 10 for all Home users - Similar Threads - Microsoft enables Tamper

Enable Tamper Protection via command

Enable Tamper Protection via command

Enable Tamper Protection via command

Enable Tamper Protection Using PowerShel or CMD

Enable Tamper Protection Using PowerShel or CMD

Cannot enable Tamper Protection in Registry

How to enable Tamper Protection on Windows Server?

How to enable Tamper Protection on Windows Server?

Windows 10 Tamper Protection