Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1005986" data-attributes="member: 32260">Today I have repeated my tests (Windows 11 Home ver 22H2 Insider OS build 25201.1000):<ol>
<li data-xf-list-type="ol">Turn Off the Internet connection.</li>
<li data-xf-list-type="ol">Start from the snapshot SAC ON.</li>
<li data-xf-list-type="ol">Run suspicious application = blocked with SAC alert. Check Event Log, blocked events logged (Id=3033 and 3077). Event Log also logs that the 4 policies were refreshed and activated (Id=3099). One of these policies is {d2bda982-...}.cip (Windows Driver Policy) which is absent in the &quot;\Active&quot; directory.</li>
<li data-xf-list-type="ol">Rename all policies in the &quot;\Active&quot; directory (reboot).</li>
<li data-xf-list-type="ol">Run suspicious application = allowed.&nbsp; Check Event Log, events not logged (reboot).</li>
<li data-xf-list-type="ol">Restore the names of original policies in the &quot;\Active&quot; directory (reboot).</li>
<li data-xf-list-type="ol">Run suspicious application = blocked with SAC alert. Check Event Log, blocked events logged.</li>
</ol>So it is possible to enable/disable SAC without turning it OFF in the Security Center. I tested this with a disabled Internet connection. So some more tests are required.I do not recommend this method on the real system, because it is not documented by anyone. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Post updated.When making a backup and restoring the policies (by copying them from the backup) the file permissions can be changed (lowered), so one has to do it by preserving NTFS file permissions. It is easier to rename the policies without removing them. In my test, I added the &quot;B&quot; letter at the front of the policy name.</blockquote>

[QUOTE="Andy Ful, post: 1005986, member: 32260"] Today I have repeated my tests (Windows 11 Home ver 22H2 Insider OS build 25201.1000): [LIST=1] [*]Turn Off the Internet connection. [*]Start from the snapshot SAC ON. [*]Run suspicious application = blocked with SAC alert. Check Event Log, blocked events logged (Id=3033 and 3077). Event Log also logs that the 4 policies were refreshed and activated (Id=3099). One of these policies is [B][COLOR=rgb(41, 105, 176)]{d2bda982-...}.cip[/COLOR][/B] (Windows Driver Policy) which is absent in the "\Active" directory. [*]Rename all policies in the "\Active" directory (reboot). [*]Run suspicious application = allowed. Check Event Log, events not logged (reboot). [*]Restore the names of original policies in the "\Active" directory (reboot). [*]Run suspicious application = blocked with SAC alert. Check Event Log, blocked events logged. [/LIST] So it is possible to enable/disable SAC without turning it OFF in the Security Center. I tested this with a disabled Internet connection. So some more tests are required. [COLOR=rgb(184, 49, 47)][B]I do not recommend this method on the real system, because it is not documented by anyone. [/B][/COLOR](y) Post updated. When making a backup and restoring the policies (by copying them from the backup) the file permissions can be changed (lowered), so one has to do it by preserving NTFS file permissions. It is easier to rename the policies without removing them. In my test, I added the "B" letter at the front of the policy name. [/QUOTE]

Verification