Endpoint protection that attackers and staff can't switch off on the device

You’re looking for endpoint protection with tamper protection—ideally centrally managed so users and malware can’t disable or uninstall the agent locally.

• Microsoft Defender for Endpoint: Tamper protection blocks changes to key Defender settings; manage it centrally through Defender or Intune. One caveat: on Windows, a local administrator can still change settings in the Windows Security app, so it may not meet a strict “staff can never switch it off” requirement on its own. (learn.microsoft.com)
• CrowdStrike Falcon: Look for policies that enable Sensor Tamper Prevention and uninstall/maintenance protection. (help.zscaler.com)
• SentinelOne Singularity: Enable Anti-Tamper; its agent policy is designed to prevent users or malware from changing, disabling, or uninstalling the agent. (helpdesk.sherweb.com)

Important: No endpoint agent is an absolute guarantee against a determined attacker with deep device control. For stronger enforcement, pair tamper protection with standard-user accounts, centrally managed policies, and alerts when protection is missing or unhealthy.

If you share your devices’ operating systems and whether you already use Microsoft 365/Intune, I can narrow this to the best-fit setup.

The feature you're describing is usually called tamper protection (or anti-tamper / agent uninstall protection). Most major endpoint products offer it, but the strength varies, and no setting fully stops a determined local administrator.

Products with this capability

• Microsoft Defender for Endpoint: Tamper protection blocks changes to antivirus and threat protection settings. Microsoft also says it will soon be turned on by default for all enterprise customers. Once set centrally, it can no longer be disabled locally. Admins can still use a Troubleshooting Mode for legitimate changes.
• Huntress: Its agent has tamper protection. Uninstalling a protected agent requires the Remote, Bulk Remote, or break-glass options, or disabling tamper protection first.
• WatchGuard EDR: Its anti-tamper feature means attackers cannot stop the Endpoint Security software. It can also require two-factor authentication for uninstalls.
• Elastic Defend: Enabling agent tamper protection means the uninstall CLI command for Elastic Agent and Elastic Endpoint requires a unique uninstall token. This needs a Platinum or higher subscription in Elastic Stack.
• Palo Alto Cortex XDR and WithSecure: These use an agent protection or uninstall password managed from their consoles, according to one comparison (Palo Alto Cortex XDR: Agent Protection + Uninstall Password via Cortex XDR Management Console).

What to check when you evaluate a product

• Central management: Settings should be enforced from the cloud or management console, not locally. Microsoft notes that Group Policy, WMI, and PowerShell methods are more susceptible to tampering than Intune or Configuration Manager.
• Uninstall and reinstall controls: Attackers have reinstalled older agents to bypass protection, so look for centrally authorized uninstall and upgrade. SentinelOne's "Online Authorization" is one example cited in this context.
• Alerting: Tampering attempts should generate alerts. Microsoft lists alert types such as Attempt to stop Microsoft Defender for Endpoint sensor.
• Vendor testing: A buyer's guide recommends asking how the agent resists driver-based and privileged kill attempts. Attackers have used vulnerable drivers to kill AV and EDR tools, so this matters.

Limits

Tamper protection is not a complete control. Elastic states that its feature does not provide comprehensive protection against all administrative attacks. The practical complement is removing local admin rights from staff, since to prevent users from uninstalling or sabotaging Elastic Defend, avoid granting them administrative privileges.

If you tell me your platform (Windows, macOS, Linux, mixed) and whether you use Intune, a cloud console, or RMM tools, I can narrow this to specific products and setup steps.

To prevent attackers and staff from switching off endpoint protection, you must move beyond simple installation and implement Tamper Protection combined with Least Privilege access controls.

Modern enterprise-grade Endpoint Detection and Response (EDR) and Antivirus (AV) platforms are designed specifically to resist attempts to disable them, even by users with local administrator rights.

1. The Core Solution: Tamper Protection

Most leading security platforms (e.g., Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Sophos) include a feature called Tamper Protection. When enabled, this feature locks the security agent’s configuration so that it cannot be modified, disabled, or uninstalled—even by a local administrator.

• How it works: It forces the security service to ignore commands from local users, unauthorized scripts, or malicious processes that attempt to change registry keys, stop services, or modify exclusion lists.
• Implementation: You must enable this centrally via your management console (e.g., Microsoft Intune, CrowdStrike Falcon Console, or Sophos Central). Once enabled, the settings are pushed to the device and enforced by the cloud policy, overriding local attempts to change them.

2. Essential Configuration Requirements

Simply enabling the product is often not enough. To ensure the protection cannot be turned off, you must enforce the following:

• Centralized Policy Enforcement: Ensure the device is managed by a central platform (MDM/UEM like Intune or a vendor-specific management console). The security policy must be "authoritative," meaning that even if someone manages to change a setting locally, the central management platform will detect the "drift" and automatically revert the setting to its secure state.
• Remove Local Admin Rights: This is the most critical step for staff. If a user is not a local administrator, they lack the privileges required to stop services, edit the registry, or uninstall software. By enforcing Standard User accounts (via Group Policy or Autopilot/Intune), you prevent the vast majority of unauthorized configuration changes.
• Headless/Hidden UI: For Microsoft Defender and some other solutions, you can configure policies to hide the user interface (Headless Mode) or restrict access to the "Virus & threat protection" settings panel, so employees are not even presented with the option to interact with the security software.

3. Recommended EDR/EPP Solutions

If you are looking for platforms with robust, proven anti-tamper capabilities, the industry leaders include:

• Microsoft Defender for Endpoint: Offers strong, built-in Tamper Protection that is highly effective when managed via Microsoft Intune.
• CrowdStrike Falcon: Known for its "single-agent" architecture that is extremely difficult to tamper with and is designed to remain active even under heavy attack.
• SentinelOne Singularity: Provides autonomous protection with deep self-protection mechanisms that prevent agents from being disabled or blinded by attackers.
• Sophos Endpoint (Intercept X): Includes "CryptoGuard" and robust anti-tampering features that protect the agent and its services.

Summary Checklist for Security Teams

Important Note: If you are currently using a solution where local admins are still able to turn off protection, it is likely that Tamper Protection is not enabled or the device is not being properly enforced by a central management policy. Consult your vendor’s documentation specifically for the "Tamper Protection" or "Policy Lock" feature.

Look for endpoint protection with centrally managed tamper protection—sometimes called anti-tamper or self-protection. It should block local users and malware from stopping services, changing protected settings, or uninstalling the agent, while allowing authorized admins to make controlled changes.

For Windows, Microsoft Defender for Business/Endpoint offers tamper protection managed through Intune or the Defender portal. A centrally managed policy takes precedence over changes made on the device by a local administrator. ¹²

When evaluating products, confirm that tamper protection is in block/enforcement mode, not audit-only, and that uninstalling or disabling the agent is also protected. For example, WatchGuard documents anti-tamper controls and an optional password requirement for local uninstall or configuration changes. ³

No endpoint agent can guarantee protection against every person with physical access or the highest-level administrative control. Pair tamper protection with restricted admin rights, centralized management, and alerts for tampering attempts. ²

Sources
¹ Microsoft: Configure tamper protection
² Microsoft: Tamper protection overview
³ WatchGuard: Configure endpoint anti-tamper settings