Reply to thread

Message

<blockquote data-quote="wat0114" data-source="post: 1021213" data-attributes="member: 91306">Oh wow, so it is for Mandatory Integrity Control. I just took a look, which I should have done earlier <img class="smilie smilie--emoji" loading="lazy" alt="😬" title="Grimacing face&nbsp; &nbsp; :grimacing:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f62c.png" data-shortname=":grimacing:" /> at Add/Manage exclusions and saw this:EDITThis Parent/Process Integrity option works as I thought it would. Very nice <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> As a test I changed the Process Integrity of C:\WINDOWS\system32\eventvwr.msc&quot; /s from Medium to High, with Parent Process C:\Windows\System32\mmc.exe kept at Medium and OSA blocked the attempt to launch event viewer <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> I even tried High/High on both Parent/Process respectively with successful block.</blockquote>

[QUOTE="wat0114, post: 1021213, member: 91306"] Oh wow, so it is for Mandatory Integrity Control. I just took a look, which I should have done earlier 😬 at Add/Manage exclusions and saw this: [B]EDIT[/B] This Parent/Process Integrity option works as I thought it would. Very nice :) As a test I changed the Process Integrity of [B]C:\WINDOWS\system32\eventvwr.msc" /s[/B] from Medium to High, with Parent Process [B]C:\Windows\System32\mmc.exe [/B]kept at Medium and OSA blocked the attempt to launch event viewer (y) I even tried High/High on both Parent/Process respectively with successful block. [/QUOTE]

Verification