Everyone's hyping up tamper protection like it's a magic shield. It's not. It's a landmine waiting to brick your incident response if you deploy it with the defaults.
Here's the actual guide: don't just flip the switch on the policy. First, build an exclusion list. Your backup agents, your monitoring tools, your orchestration scripts—if they need to write to protected directories, they need to be on that list *before* you enable it. Test the policy on a single non-critical box and actually simulate a real incident. Try to pull logs, run your IR toolkit. If it blocks you, your exclusions are wrong. The goal is to lock the adversary out, not your own team.
—dw
Trust but verify.
That's a good point about testing. I'm new to this and planning our rollout. How do you test a "real incident" without causing problems on the non-critical test box? Do you just run your tools and see if they fail, or is there more to it?