Disabling SmartScreen causes the OS to open apps very slowly (Solution) #412
Comments
|
Hi, I have some questions:
I see that it includes 3 keys and 2 values: C:\Users\undergroundwires>reg query "HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}"
HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}
(Default) REG_SZ SmartScreen
AppID REG_SZ {a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}
HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}\InProcServer32
HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}\LocalServer32We can potentially store this default values and add them back on revert.
Can you provide me steps to reproduce it? Which version of Windows do you have? Which app did start slowly? How did you observe it? Something like:
Because for me the flow above works fine. |
|
Hi, I think that it should have the same effect as to renaming it. I was just troubleshooting and saw what was happening in the event viewer and searched for that key and removed it in the HKCR directory and it worked fine after that. I wouldn't bother renaming it since I never ever want back the M$ Defender, but taking ownership of the keys in those locations takes a bit time to figure it since you have to replace the same ownership into the subkeys and etc. How it happened to me:
Also it would be good if Step 4 could be incorporated within the scripts, those files/folder in that location can be seen after running Windows Update and it installs some definition updates for M$ Defender |
|
Thank you for the info. I will research a bit more, do tests and add the fix. privacy.sexy gives Windows instruction to prevent executing |
|
You're welcome! I just forgot to add that in privacy.sexy I ticked the whole Disable M$ Defender box EXCEPT the Windows Firewall because that is needed for later if you want to bring back the M$ Store to the LTSC OSes since they are missing it |
|
I was not able to take ownership of this key. However, running the script as |
undergroundwires
added a commit
that referenced
this issue
Aug 28, 2024
Refactor Windows scripts to run as TrustedInstaller using PowerShell instead of batch files. This improves code reuse and enables more complex logic for system modifications. Key changes: - Add function to run any PowerShell script as TrustedInstaller - Refactor existing functions to use new TrustedInstaller capability - Enable soft deletion of protected registry keys and files (#412). - Resolve issues with renaming Defender files (#128). Other supporting changes: - Enhance service disabling to handle dependent services - Use base64 encoding of 'privacy.sexy' to avoid Defender alerts (#421). - Add comments to generated code for better documentation
undergroundwires
added a commit
that referenced
this issue
Aug 28, 2024
Refactor Windows scripts to run as TrustedInstaller using PowerShell instead of batch files. This improves code reuse and enables more complex logic for system modifications. Key changes: - Add function to run any PowerShell script as TrustedInstaller - Refactor existing functions to use new TrustedInstaller capability - Enable soft deletion of protected registry keys and files (#412). - Resolve issues with renaming Defender files (#128). Other supporting changes: - Enhance service disabling to handle dependent services - Use base64 encoding of 'privacy.sexy' to avoid Defender alerts (#421). - Add comments to generated code for better documentation
|
Update: I have been working extensively on this. It was painful to be able to rename keys and get these values back as trusted installer. Renaming functions do not preserve the original permissions for some reason. But this revert and do code should successfully rename Do: PowerShell -ExecutionPolicy Unrestricted -Command "function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName "^""$($scriptFile.BaseName).ps1"^"" -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = 'privacy' + '.sexy invoke'; schtasks.exe /delete /tn "^""$taskName"^"" /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed to execute with exit code: $result."^""; } } finally { schtasks.exe /delete /tn "^""$taskName"^"" /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' $acl = $null'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' $acl = Get-Acl `'+"^""`r`n"^""+' -Path $Old `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' $rule = $acl.GetAccessRules($true, $true, [System.Security.Principal.NTAccount])[0]'+"^""`r`n"^""+' $acl.RemoveAccessRuleAll($rule)'+"^""`r`n"^""+' $acl.AddAccessRule($rule)'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to read ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item `'+"^""`r`n"^""+' -LiteralPath $Old `'+"^""`r`n"^""+' -Destination $New `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item `'+"^""`r`n"^""+' -LiteralPath $Old `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -ErrorAction Stop `'+"^""`r`n"^""+' | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item `'+"^""`r`n"^""+' -LiteralPath $New `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -ErrorAction Stop `'+"^""`r`n"^""+' | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' if ($acl) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Set-Acl `'+"^""`r`n"^""+' -Path $New `'+"^""`r`n"^""+' -AclObject $acl `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to set ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}'''+"^""`r`n"^""+'$suffix=''.OLD'''+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'$global:skip = 0'+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'function Rename-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Processing key: $Path"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = (Get-Item -LiteralPath $Path -ErrorAction Stop | Select-Object -ExpandProperty Property)'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Renaming ''$value''"^""'+"^""`r`n"^""+' if ($value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $backupName = $value + $suffix'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupName''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty `'+"^""`r`n"^""+' -LiteralPath $Path `'+"^""`r`n"^""+' -Name $value `'+"^""`r`n"^""+' -NewName $backupName `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename value: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $subkeys = Get-ChildItem -LiteralPath $Path -ErrorAction SilentlyContinue'+"^""`r`n"^""+' foreach ($key in $subkeys) {'+"^""`r`n"^""+' Rename-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming key ''$Path''."^""'+"^""`r`n"^""+' if ($Path.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Has suffix.'''+"^""`r`n"^""+' $global:skip++'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' $backupPath = $Path + $suffix'+"^""`r`n"^""+' while (Test-Path -LiteralPath $backupPath) {'+"^""`r`n"^""+' $backupPath += $suffix'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$backupPath''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl `'+"^""`r`n"^""+' -Old $Path `'+"^""`r`n"^""+' -New $backupPath `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully renamed.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to rename: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Soft deleting registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Rename-KeyTree $path'+"^""`r`n"^""+'$totalItems = $global:ok + $global:skip + $global:fail'+"^""`r`n"^""+'Write-Host "^""Total items: $totalItems, Renamed: $global:ok, Skipped: $global:skip, Failed: $global:fail"^""'+"^""`r`n"^""+'if (($totalItems -eq 0) -or ($totalItems -eq $global:skip)) {'+"^""`r`n"^""+' Write-Host ''No items were processed. The operation had no effect.'''+"^""`r`n"^""+'} elseif ($global:fail -eq $totalItems) {'+"^""`r`n"^""+' throw "^""Operation failed. All $global:fail items could not be processed."^""'+"^""`r`n"^""+'} elseif ($global:ok) {'+"^""`r`n"^""+' Write-Host "^""Successfully processed $global:ok item(s)."^""'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"Revert: PowerShell -ExecutionPolicy Unrestricted -Command "function Invoke-AsTrustedInstaller($Script) { $principalSid = [System.Security.Principal.SecurityIdentifier]::new('S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464'); $principalName = $principalSid.Translate([System.Security.Principal.NTAccount]); $streamFile = New-TemporaryFile; $scriptFile = New-TemporaryFile; try { $scriptFile = Rename-Item -LiteralPath $scriptFile -NewName "^""$($scriptFile.BaseName).ps1"^"" -PassThru; $Script | Out-File $scriptFile -Encoding UTF8; $taskName = 'privacy' + '.sexy invoke'; schtasks.exe /delete /tn "^""$taskName"^"" /f 2>&1 | Out-Null; $executionCommand = "^""powershell.exe -ExecutionPolicy Bypass -File '$scriptFile' *>&1 | Out-File -FilePath '$streamFile' -Encoding UTF8"^""; $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "^""-ExecutionPolicy Bypass -Command `"^""$executionCommand`"^"""^""; $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName $taskName -Action $action -Settings $settings -Force -ErrorAction Stop | Out-Null; try { ($scheduleService = New-Object -ComObject Schedule.Service).Connect(); $scheduleService.GetFolder('\').GetTask($taskName).RunEx($null, 0, 0, $principalName) | Out-Null; $timeout = (Get-Date).AddMinutes(5); Write-Host "^""Running as $principalName"^""; while ((Get-ScheduledTaskInfo $taskName).LastTaskResult -eq 267009) { Start-Sleep -Milliseconds 200; if ((Get-Date) -gt $timeout) { Write-Warning 'Skipping: Timeout'; break; }; }; if (($result = (Get-ScheduledTaskInfo $taskName).LastTaskResult) -ne 0) { Write-Error "^""Failed to execute with exit code: $result."^""; } } finally { schtasks.exe /delete /tn "^""$taskName"^"" /f | Out-Null; }; Get-Content $streamFile } finally { Remove-Item $streamFile, $scriptFile; }; }; $cmd = 'function Rename-KeyWithAcl($Old, $New) {'+"^""`r`n"^""+' $acl = $null'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' $acl = Get-Acl `'+"^""`r`n"^""+' -Path $Old `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' $rule = $acl.GetAccessRules($true, $true, [System.Security.Principal.NTAccount])[0]'+"^""`r`n"^""+' $acl.RemoveAccessRuleAll($rule)'+"^""`r`n"^""+' $acl.AddAccessRule($rule)'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to read ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Copy-Item `'+"^""`r`n"^""+' -LiteralPath $Old `'+"^""`r`n"^""+' -Destination $New `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' throw "^""Failed to copy: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item `'+"^""`r`n"^""+' -LiteralPath $Old `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -ErrorAction Stop `'+"^""`r`n"^""+' | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Remove-Item `'+"^""`r`n"^""+' -LiteralPath $New `'+"^""`r`n"^""+' -Force `'+"^""`r`n"^""+' -Recurse `'+"^""`r`n"^""+' -ErrorAction Stop `'+"^""`r`n"^""+' | Out-Null'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to clean: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' throw "^""Failed to remove: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' if ($acl) {'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Set-Acl `'+"^""`r`n"^""+' -Path $New `'+"^""`r`n"^""+' -AclObject $acl `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed to set ACL: $_"^""'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'$rawPath=''HKLM\SOFTWARE\Classes\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}'''+"^""`r`n"^""+'$suffix =''.OLD'''+"^""`r`n"^""+'$global:fail = 0'+"^""`r`n"^""+'$global:ok = 0'+"^""`r`n"^""+'function Get-Real($s) {'+"^""`r`n"^""+' while ($s.EndsWith($suffix)) {'+"^""`r`n"^""+' $s = $s.Substring(0, $s.Length - $suffix.Length)'+"^""`r`n"^""+' }'+"^""`r`n"^""+' return $s'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Restore-KeyTree($Path) {'+"^""`r`n"^""+' Write-Host "^""Restoring key: ''$Path''"^""'+"^""`r`n"^""+' $dest = Get-Real $Path'+"^""`r`n"^""+' $src = $Path'+"^""`r`n"^""+' if (-Not $src.EndsWith($suffix)) {'+"^""`r`n"^""+' $src += $suffix'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $src)) {'+"^""`r`n"^""+' Write-Host ''Skipping: No data.'''+"^""`r`n"^""+' Restore-Children $dest'+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' if (Test-Path -LiteralPath $dest) {'+"^""`r`n"^""+' Write-Host ''Skipping to avoid data loss. Key already exists.'''+"^""`r`n"^""+' Write-Warning "^""Manual intervention may be required to fully restore from ''$src''."^""'+"^""`r`n"^""+' } else {'+"^""`r`n"^""+' Write-Host "^""Restoring key from ''$src''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-KeyWithAcl `'+"^""`r`n"^""+' -Old $src `'+"^""`r`n"^""+' -New $dest `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully restored.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' Restore-Children $dest'+"^""`r`n"^""+'}'+"^""`r`n"^""+'function Restore-Children($Path) {'+"^""`r`n"^""+' Write-Host "^""Restoring values in ''$Path''"^""'+"^""`r`n"^""+' if (-Not (Test-Path -LiteralPath $Path)) {'+"^""`r`n"^""+' Write-Host ''Skipping: Key does not exist. No action needed.'''+"^""`r`n"^""+' return'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $values = ( `'+"^""`r`n"^""+' Get-Item `'+"^""`r`n"^""+' -LiteralPath $Path `'+"^""`r`n"^""+' -ErrorAction Stop `'+"^""`r`n"^""+' | Select-Object -ExpandProperty Property `'+"^""`r`n"^""+' )'+"^""`r`n"^""+' foreach ($value in $values) {'+"^""`r`n"^""+' Write-Host "^""Restoring value ''$value''"^""'+"^""`r`n"^""+' if (-Not $value.EndsWith($suffix)) {'+"^""`r`n"^""+' Write-Host ''Skipping: No action needed.'''+"^""`r`n"^""+' continue'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $real = Get-Real $value'+"^""`r`n"^""+' Write-Host "^""Renaming to ''$real''."^""'+"^""`r`n"^""+' try {'+"^""`r`n"^""+' Rename-ItemProperty `'+"^""`r`n"^""+' -LiteralPath $Path `'+"^""`r`n"^""+' -Name $value `'+"^""`r`n"^""+' -NewName $real `'+"^""`r`n"^""+' -ErrorAction Stop'+"^""`r`n"^""+' Write-Host ''Successfully restored.'''+"^""`r`n"^""+' $global:ok++'+"^""`r`n"^""+' } catch {'+"^""`r`n"^""+' Write-Warning "^""Failed: $_"^""'+"^""`r`n"^""+' $global:fail++'+"^""`r`n"^""+' }'+"^""`r`n"^""+' }'+"^""`r`n"^""+' $keys = Get-ChildItem `'+"^""`r`n"^""+' -LiteralPath $Path `'+"^""`r`n"^""+' -ErrorAction SilentlyContinue'+"^""`r`n"^""+' foreach ($key in $keys) {'+"^""`r`n"^""+' Restore-KeyTree $key.PSPath'+"^""`r`n"^""+' }'+"^""`r`n"^""+'}'+"^""`r`n"^""+'Write-Host "^""Restoring registry key ''$rawPath'' recursively."^""'+"^""`r`n"^""+'$hive = $rawPath.Split(''\'')[0]'+"^""`r`n"^""+'$path = $hive + '':'' + $rawPath.Substring($hive.Length)'+"^""`r`n"^""+'Restore-KeyTree $path'+"^""`r`n"^""+'if ($global:fail) {'+"^""`r`n"^""+' Write-Error ''Failed to restore'''+"^""`r`n"^""+' Exit 1'+"^""`r`n"^""+'}'; Invoke-AsTrustedInstaller $cmd"Feel free to test this. This issue also inspired me to do things. We should probably delete all registry keys related to smart screen based on this. Do you agree @Nub865 ? I also see that there are hundreds of other CLSIDs (other similar COM registrations) related to Defender and its component, I may add them all at once too. |
|
Hi, I tested it and now it works as it should. Good job! The MsMpEng.exe is still running so I guess I will have to boot from live linux distro to delete the folder with the numbers in C:\ProgramData\Microsoft\Windows Defender\Platform but that's okay, I can manage it (from step 4) Edit: I also know that there are other registry keys with the same name, in the beginning when I saw there were hundreds of them I figured that it would be pointless to delete them all except the 2 that I mentioned in here |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
On Windows 11 Enterprise LTSC IoT (latest updates), after disabling MS Defender (including SmartScreen), rebooting, then running sfc /scannow the issue starts to happen after a reboot
Solution: DCOM cannot start smartscreen under this key {a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}
Open regedit and navigate to HKEY_CLASSES_ROOT\AppID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d}
Take ownership of that key and delete it
Navigate to HKEY_CLASSES_ROOT\CLSID\{a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d} and do the same and delete the key.
Would be good if this was incorporated into the scripts
The text was updated successfully, but these errors were encountered: