Free tools Windows power users keep installed
One-click scans. No signup required.
An alert that someone tried to disable endpoint protection is a high-signal lead, not proof that an attacker succeeded or that the device is fully compromised. First establish what changed and whether protection is still active; then trace the process, user, device and surrounding activity, preserve the evidence, and follow your incident-response plan. Microsoft warns that “Tampering attempts might indicate a larger cyberattack.”
What an endpoint-tampering alert does—and does not—tell you
Attackers may try to turn off antivirus, alter exclusions, stop or modify an endpoint detection and response (EDR) sensor, or bypass tamper protection to evade detection. Microsoft Defender for Endpoint can report these attempts, but the event alone does not establish that a setting changed, that protection was disabled, or that the activity was malicious. An authorized administrator or a blocked configuration change can also warrant investigation.
As an Amazon Associate I earn from qualifying purchases.
Nor is the alert feed a complete record of relevant activity. Microsoft says some activity that is not correlated with suspicious behavior may not generate an alert, while still appearing in the device timeline and advanced hunting. Check those sources even when no alert is present.
Investigate the event and determine the endpoint’s current state
- Open the alert or endpoint event. In Microsoft Defender for Endpoint, review the alert’s reason, affected assets and entities, and events immediately before and after the attempt. Alert titles can vary by activity and operating system.
- Trace who or what initiated it. Use the process tree and device timeline to connect the initiating process and file with the user and device. Check whether related configuration changes, exclusions, account activity, or other alerts occurred around the same time.
- Search beyond the alert feed. Microsoft documents this advanced-hunting query for recent Defender tampering events:
DeviceEvents
| where Timestamp > ago(10d)
| where ActionType == "TamperingAttempt"Adjust the time window and add an appropriate device filter for the incident. The example searches the preceding 10 days; it is not a guarantee that every tampering event will be present or that events older than the selected window are irrelevant.
#1 Best Overall
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
- Verify whether protection actually changed. Compare the endpoint’s current security state with the event, device timeline and management policy. On Windows with Microsoft Defender Antivirus, Microsoft documents this PowerShell command for checking tamper-protection and real-time-protection status:
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabledUse the result alongside the relevant event records and configuration; a status check by itself does not identify who initiated an attempted change or why.
Interpret blocked changes and policy precedence on Windows
A setting may appear to have been changed locally even though Defender blocked it. Microsoft identifies Event ID 5013 as a Defender Antivirus event indicating that tamper protection blocked a setting change. Check which setting was targeted, the initiating identity and process, and whether the endpoint’s protection state changed afterward.
Management policy can also explain why a local or portal setting does not match the device’s effective configuration. In Microsoft’s documented configuration hierarchy, Intune policy takes precedence over organization-wide portal settings, which take precedence over local Windows Security configuration. Tamper protection is on by default for new deployments as part of built-in protection, but its actual state depends on the product, license, onboarding and management prerequisites.
Rank #2
- Watchguard Tech WG50021 Firebox X20e-Wireless
Decide whether the attempt is part of a wider incident
Correlate the event with activity on the same device and account, including process execution, configuration or exclusion changes, other security alerts, and events on neighboring devices. An attempt to weaken defenses can be part of a broader intrusion, but its significance depends on the evidence and context.
If the evidence points to malicious activity or a compromised endpoint, escalate through your organization’s incident-response plan. Coordinate containment and evidence handling with the incident lead and the owner of the endpoint or security tool. The appropriate actions depend on the scope and your organization’s procedures; the Microsoft guidance described here does not establish a universal sequence for network isolation, credential resets or rebuilding.
Preserve evidence before making changes
Retain the alert and relevant endpoint records before altering settings or beginning remediation. For Windows Defender troubleshooting mode, Microsoft describes capturing a Defender preference snapshot before and near the end of the mode, collecting operational logs while it is active, and making data available through the portal device timeline, Event Viewer, an investigation package and advanced hunting. Preserve the records relevant to your investigation under your organization’s evidence-handling policy.
Rank #3
- XGS 88 with 3 Years Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- Equipped with 4 x 2.5 GE copper ports, supporting up to 9.9 Gbps firewall performance for small offices and branch deployments.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
Use troubleshooting mode only for a controlled diagnostic test
Microsoft’s Windows troubleshooting mode is for temporarily testing specified policy-managed Defender Antivirus settings—not for routine response to a suspected attack. It can expose the device to risk while protection is disabled, and the device must be online for temporary tamper-protection disablement. Changes made during the mode are temporary; when it expires, settings return to policy-managed values.
- Establish the issue and capture the relevant alert, process, timeline and configuration evidence first.
- Use troubleshooting mode only when a legitimate diagnostic need justifies the temporary risk, and follow Microsoft’s current product guidance for enabling and managing it.
- Capture the process or performance evidence needed to identify the cause. If an exclusion is being considered, test only a narrowly scoped exclusion and retain it only if testing confirms it is necessary.
- After the test, confirm real-time protection and the effective policy-managed settings are restored. Review the before-and-after preference snapshots and operational logs, and collect the investigation package if needed.
Account for platform and product differences
Microsoft Defender for Endpoint on Linux
As of October 4, 2026, Microsoft’s cited Linux tamper-protection capability is described as a Preview in audit mode: it detects and reports specified configuration-file modifications, deletions, renames or moves, and Defender process termination or restart activity, including actions by root, but does not block those actions. The documented eligibility includes Microsoft Defender for Endpoint version 101.26072.0004 or later from Insiders-Slow, along with supported distributions and kernels and a gradual rollout to eligible devices. Because this is a preview with version, kernel and rollout requirements, verify current eligibility before relying on it.
Other endpoint products
Do not assume Defender’s event names, alert coverage, command syntax, policy precedence or restoration behavior applies to another antivirus or EDR product. Consult that product’s current official documentation for its telemetry and controls, and use your organization’s incident-response procedure for investigation and containment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
