Kooxda Amniga Windows waxay soo saartay Ilaalinta Tamper^{(Tamper Protection)} ee dhammaan isticmaalayaasha Windows . Maqaalkan, waxaanu ku wadaagi doonaa sida aad awood ugu yeelan karto ama aad u joojin karto Ilaalinta Tamper^{( Tamper Protection)} gudaha Windows Security ama Difaaca Windows^{(Windows Defender)} iyada oo loo marayo UI, Registry ama InTune . Inta aad damin karto, waxaanu aad kuugula talinaynaa in aad karti u yeelato mar kasta, si aad u ilaaliso.

Waa maxay Ilaalinta Tamper^{(Tamper Protection)} ee Windows 11/10

Ingiriisi^(English) fudud , waxa ay hubisaa in qofna aanu faragelin karin nidaamka Ilaalinta^(Protection) aka Windows Security . Software-ka dusha saaran ayaa ku filan inuu wax ka qabto inta badan khataraha amniga, oo uu ku jiro Ransomware . Laakin haddii uu damiyo software dhinac saddexaad ah ama malware kaas oo si dhuumasho ah ku soo gala, markaas dhibaato ayaad geli kartaa.

Qaabka Ilaalinta Tamper^{(Tamper Protection feature)} ee Amniga Windows^{(Windows Security)} waxay hubisaa inay ka hortagto abka xaasidnimada leh inay beddelaan dejimaha Difaaca^{(Windows Defender Antivirus)} Kahortagga ee Windows ee khuseeya . Astaamaha sida ilaalinta waqtiga-dhabta ah^(Real-time) , ilaalinta daruuraha ayaa lama huraan ah si ay kaaga ilaaliso khataraha soo baxaya. Sifada ayaa sidoo kale hubinaysa in qofna aanu bedeli karin ama wax ka beddeli karin habaynta iyada oo loo marayo Diiwaangelinta^(Registry) ama Siyaasadda Kooxda^{(Group Policy)} .

Waa kan waxa Microsoft ay arrintan ka leedahay:

• Si aad gacan uga geysato hubinta in Ilaalinta Tamper^{(Tamper Protection)} aysan faragelin agabka amniga cid saddexaad ama qoraallada rakibaadda ganacsiga ee wax ka beddelaya goobahan, aad Windows Security oo cusboonaysii xogta amniga nooca 1.287.60.0 ama ka dib. Marka aad sameyso cusboonaysiintan, Ilaalinta Tamper^{(Tamper Protection)} waxay sii wadi doontaa inay ilaaliso dejimahaaga diiwaanka waxayna geli doontaa isku dayo lagu beddelayo iyaga oo aan soo celin khaladaadka.
• Haddii goobta ilaalinta Tamper^{(Tamper Protection)} -ku uu shido , ma awoodi doontid inaad damiso adeegga difaaca Windows^{(Windows Defender Antivirus)} -ka ee Kahortagga fayraska adiga oo isticmaalaya  fure siyaasadda kooxda DisableAntiSpyware  .

Ilaalinta Tamper^{(Tamper Protection)} si toos ah ayaa loogu furay isticmaalayaasha Guriga^(Home) . Ilaalinta Tamper^{(Tamper Protection)} -ka oo shidan macnaheedu maaha inaadan rakibin karin fayraska qolo saddexaad. Waxa kaliya oo ay la macno tahay in software kale aanu bedeli karin habaynta Amniga Windows^{(Windows Security)} . Ka-hortagga-ka-hortagga qolo saddexaad^{(Third-party)} waxay sii wadi doontaa inay iska diiwaan geliso codsiga Amniga Windows^{(Windows Security)} .

Dami Ilaalinta Tamper^{(Tamper Protection)} ee Amniga Windows^{(Windows Security)}

Halka qolo saddexaad laga xannibay inay wax isbeddel ah sameeyaan, adigu maamule ahaan waxaad samayn kartaa isbeddellada. In kasta oo aad awooddo, waxaanu si weyn kuugula talinaynaa inaad mar walba karti siiso. Waxaad u habayn kartaa saddex siyaabood:

1. Windows Security UI
2. Isbeddelka diiwaanka
3. InTune ama Microsoft 365 Xariirka Maareynta Qalabka^{(Device Management)}

Ma jirto Siyaasad Kooxeed^{(Group Policy Object)} oo lagu beddelayo goobtan.

1] Isticmaalka Windows Security UI si aad u joojiso ama awood u siiso Ilaalinta Tamper

• Guji badhanka ^(Click)Start , iyo liiska abka, hel Windows Security . Guji^(Click) si aad u bilowdo markaad hesho
• U beddel Fayraska^(Virus) iyo ka hortagga Hanjabaada ^(Threat)> Manage Settings
• Xoogaa^(Scroll) rog si aad u hesho Ilaalinta Tamper ^{(Tamper Protection)}Hubi^(Make) inuu shidmay
• Haddii ay jirto baahi gaar ah, waad dami kartaa, laakiin hubi inaad dib u shido marka shaqada la dhammeeyo.

2] Isbeddellada diwaangelinta^(Registry) si loo joojiyo ama loo suurtageliyo ilaalinta Tamper

• Furo Registry Editor adiga oo ku qoraya Regedit Run Prompt oo ay ku xigto furaha Gelida^(Enter)
• ^(Navigate)U soco HKEY_LOCAL_MACHINESOFTWAREMIFeatures HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
• Laba jeer guji DWORD TamperProtectionsi aad u saxdo qiimaha.
• U deji "0" si aad u joojiso Ilaalinta Tamper^{(Tamper Protection)} ama "5" si aad awood ugu siiso Ilaalinta Tamper^{(Tamper Protection)}

3] Daar ama dami Ilaalinta Tamper ee^{(Turn Tamper Protection)} ururkaaga addoo isticmaalaya Intune

Haddii aad isticmaalayso InTune , ie Microsoft 365 Bogga ^{(Microsoft 365)} Maareynta Qalabka^{(Device Management)} , waxaad u isticmaali kartaa inaad damiso Ilaalinta Tamper^{(Turn Tamper Protection)} -ga . Marka laga reebo inaad haysato rukhsad habboon, waxaad u baahan tahay inaad haysato kuwan soo socda:

Haddii aad ka mid tahay kooxda ammaanka ee ururkaaga, waxaad dami kartaa (ama damin kartaa ilaalinta Tamper^{(Tamper Protection)} ) ee ururkaaga gudaha Microsoft 365 Management Device^{(Device Management)} portal ( Intune ) adiga oo u malaynaya in ururkaagu leeyahay Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP):

• Ururkaagu waa inuu lahaadaa difaaca Microsoft ATP E5^{(Microsoft Defender ATP E5)} , oo ay maamusho Intune , oo ku shaqeeya Windows OS 1903 ama ka dib.
• Amniga Windows^(Windows) oo leh sirta amniga oo la cusboonaysiiyay nooca 1.287.60.0 (ama ka sareeya)
• Mashiinnadaadu waa inay isticmaalayaan nooca madal-ka-hortagga-malware-ka 4.18.1906.3 (ama ka sarreeya) iyo nooca engine-ka-hortagga 1.1.15500.X (ama ka sarreeya)

Hadda raac tillaabooyinka si aad awood ugu yeelato ama u joojiso Ilaalinta Tamper:

1. Tag bogga Maareynta Qalabka ^{(Device Management)}Microsoft 365 oo ku gal koontadaada shaqada ama dugsiga.
2. Dooro  habaynta^{(Device configuration)} aaladda  >  Profiles
3. Samee profile ay ku jiraan dejinta soo socota:
   • Platform : Windows 10 iyo wixii ka dambeeya
   • ProfileType : Ilaalinta barta dhamaadka
   • Dejinta^(Settings) > Windows Defender Security Center > Tamper Protection . Ku habbee shid ama dami
4. U qoondee^(Assign) astaanta hal ama dhowr kooxood

Haddii aadan isla markiiba arkin doorashadan, weli waa la soo saarayaa.

Mar kasta oo isbeddel dhaco, digniin ayaa lagu soo bandhigi doonaa Xarunta Ammaanka^{(Security Center)} . Kooxda nabadgelyadu waxay ka shaandhayn karaan logyada iyagoo raacaya qoraalka hoose:

AlertEvents | where Title == "Tamper Protection bypass"

Ma jirto Shay Siyaasad Kooxeed^{(Group Policy Object)} oo loogu talagalay Ilaalinta Tamper^{(Tamper Protection)}

Ugu dambeyntii, ma jirto Siyaasad Kooxeed^{(Group Policy)} oo la heli karo si loo maamulo kombiyuutaro badan. Qoraal ay Microsoft soo saartay waxay ^(Microsoft) si cad u leedahay:^{(clearly says:)}

Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.

Waxaad u isticmaali kartaa habka Diiwaangelinta^(Registry) kombiyuutaro badan adiga oo meel fog ku xiraya kombuyutarkaas, oo geynaya isbeddelka. Marka la sameeyo, tani waa sida ay u eegi doonto isticmaalayaasha goobaha gaarka ah:

Waxaan rajeyneynaa in tillaabooyinka ay fududaayeen in la raaco, waxaadna awooday inaad karti u yeelato ama aad gabto Ilaalinta^(Protection) Tamper sida looga baahan yahay.

Enable or disable Tamper Protection using Intune, REGEDIT, UI

Windows Security Team hаs rolled out Tamper Protection fоr all Windоws users. In this pоst, we will share how you can enable or disable Tamper Protection in Windows Security or Windows Defender via UI, Registry or InTune. While you can turn it off it, we highly recommend you keep it enabled at all times, for your protection.

What is Tamper Protection in Windows 11/10

In simple English, it makes sure nobody can tamper with the Protection system aka Windows Security. The onboard software is good enough to handle most of the security threats, including Ransomware. But if it is turned off by a third party software or a malware which sneaks in, then you can get into trouble.

Tamper Protection feature in Windows Security makes sure to prevent malicious apps from changing relevant Windows Defender Antivirus settings. Features like Real-time protection, cloud protection are essential to keep you safe from emerging threats. The feature also makes sure that nobody can change or modify the settings via Registry or Group Policy.

Here is what Microsoft says about it:

• To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to Windows Security and update security intelligence to version 1.287.60.0 or later. Once you’ve made this update, Tamper Protection will continue to protect your registry settings and will log attempts to modify them without returning errors.
• If the Tamper Protection setting is On, you won’t be able to turn off the Windows Defender Antivirus service by using the DisableAntiSpyware group policy key.

Tamper Protection is enabled by default for Home users. Keeping Tamper Protection On doesn’t mean that you cannot install third-party antivirus. It only means no other software can change the settings of Windows Security. Third-party antivirus will continue to register with the Windows Security application.

Disable Tamper Protection in Windows Security

While third parties are blocked from making any changes, you as an administrator can make the changes. Even though you can, we will highly recommend you to keep it enabled all the time. You can configure it in three ways:

1. Windows Security UI
2. Registry changes
3. InTune or Microsoft 365 Device Management portal

There is no Group Policy Object to change this setting.

1] Using Windows Security UI to disable or enable Tamper Protection

• Click on the Start button, and from the app list, locate Windows Security. Click to launch when you find it.
• Switch to Virus and Threat protection > Manage Settings
• Scroll a bit to find Tamper Protection. Make sure its toggled On.
• If there is a particular need, you may turn it off, but make sure to turn it on again when work is done.

2] Registry changes to disable or enable Tamper protection

• Open Registry Editor by typing Regedit in the Run Prompt followed by the Enter key
• Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
• Double click on DWORD TamperProtection to edit the value.
• Set it to “0” to disable Tamper Protection or “5” to enable Tamper Protection

3] Turn Tamper Protection on or off for your organization using Intune

If you are using InTune, i.e. Microsoft 365 Device Management portal, you can use it to Turn Tamper Protection on or off. Apart from having appropriate permissions, you need to have the following:

If you are part of your organization’s security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune) assuming your organization has Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP):

• Your organization must have Microsoft Defender ATP E5, Managed by Intune, and running Windows OS 1903 or later.
• Windows security with security intelligence updated to version 1.287.60.0 (or above)
• Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above)

Now follow the steps to enable or disable Tamper Protection:

1. Go to the Microsoft 365 Device Management portal and sign in with your work or school account.
2. Select Device configuration > Profiles
3. Create a profile that includes the following settings:
   • Platform: Windows 10 and later
   • ProfileType: Endpoint protection
   • Settings > Windows Defender Security Center > Tamper Protection. Configure it on or off
4. Assign the profile to one or more groups

If you do not see this option right away, it is still being rolled out.

Whenever a change occurs, an alert will be displayed on the Security Center. The security team can filter from the logs by following the text below:

AlertEvents | where Title == "Tamper Protection bypass"

No Group Policy Object for Tamper Protection

Lastly, there is no Group Policy available to manage multiple computers. A note by Microsoft clearly says:

Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.

You can use the Registry method for multiple computers by remotely connecting to that computer, and deploying the change. Once done, this is how it will look in users individual settings:

We hope the steps were easy to follow, and you were able to enable or disable Tamper Protection as per your requirement.

Related posts

• Daar Ilaalinta Barnaamijka aan la rabin: GPO, Regedit, PowerShell

• Waa maxay astaanta Ilaalinta Tamper ee gudaha Windows 11/10

• Daar oo ku habbee Ilaalinta Ransomware ee Difaaca Windows

• Sida loogu daro ama looga saaro abka gudaha Ka faa'iidaysiga Ilaalinta ee Windows 10

• Sida loo nadiifiyo Taariikhda Ilaalinta Difaaca Windows gudaha Windows 10

• Ku xannibo daabacaadda faraha Canvas ee Chrome oo wata difaac Canvas

• Fayraskaga iyo ilaalinta khatarta waxaa maamula ururkaaga

• Isla markiiba ku beddel Dejinta Ammaanka Windows ConfigureDefender

• Difaaca Windows si toos ah uguma cusbooneysiin gudaha Windows 11/10

• Waa maxay WDAGUtilityAccount gudaha Windows 11/10? Ma tirtiraa?

• Hagaaji qaladka Difaaca Microsoft 0x80073b01 gudaha Windows 11/10

• Xaggee lagu kaydiyaa diiwaannada iskaanka khadka-la'aanta ee Difaaca Windows?

• Hagaaji koodka qaladka Difaaca Windows 0x8050800c gudaha Windows 11/10

• Ka ilaali isticmaalayaasha inay wax ka beddelaan Ilaalinta Ka faa'iidaysiga ee Amniga Windows

• Hagaaji qaladka Difaaca Windows 0x800b0100 gudaha Windows 11/10

• Sida loo furo Xarunta Amniga Windows gudaha Windows 11/10

• Kordhinta Codsiga Difaaca Windows ee Chrome & Firefox

• Hagaaji qaladka Difaaca Microsoft 0x80004004 gudaha Windows 11/10

• Sida loo joojiyo Soo-gudbinta Tusaalaha Tooska ah ee Difaaca Microsoft

• Ka saar astaanta Ogeysiinta Difaacaha Windows gudaha Windows 10