Fix your XSS Vulnerability!
I'm really just repeating Ander's comment, but it is the only correct answer so I'm posting it as an answer.
You are suffering from the X-Y problem. You don't want to stop an attacker from using window.location. You need to find and plug your XSS vulnerability, remove all stored XSS from your system, and hope he didn't use other XSS to steal your admin credentials for the system.
Implement a CSP (content security policy)
If you need a "quick" fix in place to mitigate the damage from XSS while you find and plug the hole, you can attempt to implement a strict CSP. If done properly a CSP may be able to stop your attackers payload from running altogether. Note that this is not a fool-proof solution, as CSPs can have their own challenges - depending on how you have your site setup, you may block your own scripts, and depending on how the stored XSS payload is injected into your page, it may be hard to get a CSP to block it. Also, the CSP header isn't supported by all browsers.
In general though a strict CSP can bring XSS to a screeching halt though, so it is absolutely worth implementing.