The protection_enabled key indicates whether xAgent protection is activated. Valid values are true (protection is activated) and false (protection is not activated). The default is true.
Important
Trellix does not recommend disabling your Tamper Protection policy because it may allow users with administrative rights, threat actors, and malware to compromise your endpoint protection.
This protection is provided for Endpoint Security (HX) xAgents version 20 or later running on Windows endpoints only. The protection_enabled key restricts tampering of the registry key hierarchy by preventing unknown binaries being loaded into the xAgent process.
The protection_enabled setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"cpu_limit": 100,
deny_local_admin_stop: true
"priority": "idle",
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (See Configuring a Tamper Protection Policy).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).