Tamper Protection

[splinterededge]

How are you guys dealing with this? Tamper Protection is switched off successfully during servicing with NTlite, but apply an update and it returns.

 

[scaramonga]

Most things will return after an update. Lock it down, and do security updates only.

 

[splinterededge]

Thanks for the reply, I have a pretty good spread of configurations and a lot of experience working with NTlite and windows in general. The sole thing that is giving trouble keeping Tamper Protection protection disabled. You mention locking it down, are you suggesting setting this gpedit.msc so that the policy state matches what I am setting in the registry? I can try that.

Would love to hear your thoughts on that.

 

[splinterededge]

Thanks for the reply, I have a pretty good spread of configurations and a lot of experience working with NTlite and windows in general. The sole thing that is giving trouble keeping Tamper Protection protection disabled. You mention locking it down, are you suggesting setting this gpedit.msc so that the policy state matches what I am setting in the registry? I can try that.

Would love to hear your thoughts on that.

On the topic of returning components after an update, I did a test run and removed something close to 1000's components, all but 83 of them returned.

The enduring removal list, these ones stay gone, plus or minus a few, your milage may vary.

<RemoveComponents AppRemovalMode="Custom" RemovalMode="Custom" RemovalModeAppCleanup="true">
<c>branchcacheclient 'BranchCache Client'</c>
<c>clipchamp.clipchamp 'Clipchamp'</c>
<c>cloudid 'Microsoft Cloud Identity Service'</c>
<c>defenderantivirus 'Microsoft Defender Antivirus'</c>
<c>driver_athw8x.inf</c>
<c>driver_bcmwdidhdpcie.inf</c>
<c>driver_helloface.inf</c>
<c>driver_mrvlpcie8897.inf</c>
<c>driver_net1ic64.inf</c>
<c>driver_net2ic68.inf</c>
<c>driver_net8192se64.inf</c>
<c>driver_netathr10x.inf</c>
<c>driver_netathrx.inf</c>
<c>driver_netbc63a.inf</c>
<c>driver_netbc64.inf</c>
<c>driver_netr28x.inf</c>
<c>driver_netrtwlane.inf</c>
<c>driver_netrtwlane01.inf</c>
<c>driver_netrtwlane_13.inf</c>
<c>driver_netwbw02.inf</c>
<c>driver_netwew00.inf</c>
<c>driver_netwew01.inf</c>
<c>driver_netwlv64.inf</c>
<c>driver_netwns64.inf</c>
<c>driver_netwsw00.inf</c>
<c>driver_netwtw02.inf</c>
<c>driver_netwtw04.inf</c>
<c>driver_netwtw06.inf</c>
<c>driver_netwtw08.inf</c>
<c>driver_netwtw10.inf</c>
<c>driver_rtcx21x64.inf</c>
<c>driver_ufxchipidea.inf</c>
<c>driver_ufxsynopsys.inf</c>
<c>driver_vmxnet3.inf</c>
<c>fciclient 'File Server Resource Manager'</c>
<c>flipgridpwa 'Flipgrid PWA (InboxApp)'</c>
<c>kerneldebug 'Kernel Debugging'</c>
<c>lockscreens 'Lock Screen backgrounds'</c>
<c>manifestbackup 'Manifest Backup (WinSxS\Backup)'</c>
<c>mediaplayer 'Windows Media Player'</c>
<c>mediaplayer32 'Windows Media Player - 32 bit'</c>
<c>mediaplayernetworksharing 'WMP Network Sharing Service'</c>
<c>mediaplayernetworksharing32 'WMP Network Sharing Service - 32 bit'</c>
<c>microsoft.applicationcompatibilityenhancements 'Windows Application Compatibility Enhancements'</c>
<c>microsoft.bingnews 'Microsoft News'</c>
<c>microsoft.bingsearch 'Microsoft Bing'</c>
<c>microsoft.bingweather 'MSN Weather'</c>
<c>microsoft.gamingapp 'Xbox App'</c>
<c>microsoft.gethelp 'Get Help'</c>
<c>microsoft.microsoftedgedevtoolsclient 'Microsoft Edge DevTools Client'</c>
<c>microsoft.microsoftofficehub 'Microsoft 365 Copilot'</c>
<c>microsoft.microsoftsolitairecollection 'Solitaire &amp; Casual Games'</c>
<c>microsoft.microsoftstickynotes 'Microsoft Sticky Notes'</c>
<c>microsoft.outlookforwindows 'Outlook for Windows'</c>
<c>microsoft.powerautomatedesktop 'Power Automate'</c>
<c>microsoft.sechealthui 'Windows Security'</c>
<c>microsoft.todos 'Microsoft To Do'</c>
<c>microsoft.windows.apprep.chxapp 'SmartScreen'</c>
<c>microsoft.windows.devhome 'Dev Home'</c>
<c>microsoft.windowsalarms 'Windows Clock'</c>
<c>microsoft.windowsfeedbackhub 'Feedback Hub'</c>
<c>microsoft.windowssoundrecorder 'Windows Sound Recorder'</c>
<c>microsoft.xbox.tcui 'Xbox TCUI'</c>
<c>microsoft.xboxgamingoverlay 'Game Bar'</c>
<c>microsoft.xboxspeechtotextoverlay 'Game Speech Window'</c>
<c>microsoft.yourphone 'Phone Link'</c>
<c>microsoft.zunemusic 'Windows Media Player'</c>
<c>microsoftcorporationii.quickassist 'Quick Assist'</c>
<c>microsoftwindows.client.webexperience 'Windows Web Experience Pack'</c>
<c>microsoftwindows.crossdevice 'Mobile devices'</c>
<c>msteams 'Microsoft Teams'</c>
<c>oskthemes 'On-Screen Keyboard (Windows Personalization themes)'</c>
<c>outlookpwa 'Outlook PWA (InboxApp)'</c>
<c>printmgmt 'Print Management'</c>
<c>sleepstudy 'Sleep Study'</c>
<c>soundthemes 'Sound Themes'</c>
<c>sourcessxsdir 'Manual feature repository'</c>
<c>stepsrecorder 'Steps Recorder'</c>
<c>supportdir 'Support directory'</c>
<c>wallpapers 'Wallpapers (Themes)'</c>
<c>windows.cbspreview 'Windows Barcode Preview'</c>
</RemoveComponents>