SegoCode / DebloBat

⚙️ Yet another (and ugly) debloat, optimizer and tweaker for Windows 11 based on group policies
Other
45 stars 3 forks source link

[BUG REPORT] - TrustedInstaller Permissions for Windows Defender Configurations #2

Closed SegoCode closed 7 months ago

SegoCode commented 1 year ago

Description

Deblobat requires TrustedInstaller permissions to carry out certain Windows Defender configurations and to remove specific windows components. However, these permissions are not being granted, limiting the functionality of the program in environments controlled by Windows Defender.

Steps to reproduce

  1. Launch deblobat.
  2. Apply settings related to Windows Defender.

Expected behavior

The settings should be successfully applied to Windows Defender.

Actual behavior

When Windows Defender detects a potential threat or suspicious activity involving registry keys, it may lock those keys to prevent unauthorized modifications. As a result, deblobat is unable to make the desired changes to Windows Defender settings and components.

Please provide your Windows version

Windows 10

Confirmation

SegoCode commented 1 year ago

As a solution, we've implemented a privilege escalation to TrustedInstaller in deblobat. Done this through PowerShell, using the AtlasOS script as a reference, still pending refactoring and testing https://github.com/SegoCode/DebloBat/commit/8b8599bf2ca1699713b1337fa4e23da69951d14f