Anti-Tamper protection should be disabled first as to prevent the first changes from being blocked due to tamper protection blocking them prior to being disabled (Working on a POC that bypass's the need to access's the registry and interacts directly with the Service as trusted installer, should be done before the new MS security patch's hit the Commercial Release Channel)