Hence relevant registry values have been modified through code: 'HKEYLOCALMACHINESOFTWAREPoliciesMicrosoftWindows DefenderThreatsThreatSeverityDefaultAction'. So my question is: How can I force the SEPM to send down a policy that disables (unchecks) the Tamper Protect box? I know that I can switch to server control mode for a couple hours and the setting will be sent down to all online clients.but that seems like a kludgy way to do things and only gets the online clients. Users should have options to choose actions for infected files like quarantine or remove or report only. The problem is this, we run in 'Mixed Mode' and every time a new client comes out (MP2 in this case) and is pushed down from our SEPM, Tamper Protect gets re-enabled or if it's a new install, tamper protect is enable by default. Solution: Now the schedule always runs based on the scheduled report time, rather than based on the time that the previous scheduled report ended. Tamper Protect seems to conflict with our two factor authentication software and unfortunately.upgrading the two factor software is not an option. Fix ID: 2703519 Symptom: You receive the scheduled report for the Comprehensive Risk Report by email, but there seems to be a one-minute delay in the start time every day.

Select the Tamper Protection tab and uncheck Protect Symantec security.

We have an issue with SEP (and SAV for that matter) assisting in a BSOD with a stop 50 error if 'Tamper Protect' is enabled when a machine is rebooted. SIOS Technology is currently working with Symantec on compatibility issues.

Tamper protection symantec