Your organization has onboarded all Windows 11 devices to Microsoft Defender for Endpoint. A recent incident revealed that malware attempted to disable real-time protection and modify Defender registry keys before being blocked. The security team wants to ensure that no local process, user, or third-party tool can turn off or reconfigure Defender antivirus settings on managed endpoints. Which endpoint setting should you enable to meet this requirement?