Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
WDAC documentation incorrectly states that you can disable Smart Application Control by setting the REG_DWORD VerifiedAndReputablePolicyState to a value of 0 and using CiTool.exe -r OR rebooting the device. This is unfortunately not correct, on reboot WDAC/CI DOES NOT notify Defender of the CI policy change (Smart App Control/SmartLocker disabled) so the Defender registry key Smartlockermode never gets updated, leading to Defender never being disabled when 3rd party AV is installed. CSS has multiple cases that span across Windows Devices and Deployment, Escalations to the Windows EEs, Windows Defender for Endpoint, and several ICMs to their PG teams as well.
- Loading branch information