Forum Discussion

StevenRPF's avatar
StevenRPF
Brass Contributor
Oct 14, 2021

Exploit Protection block Teams call to Win32k.sys

Hi,

 

Is it normal than almost all PC in our business have this warning in eventviewer :

 

Microsoft-Windows-Security-Mitigations
EventID: 10 Le processus « \Device\HarddiskVolume2\Users\JoeBlo\AppData\Local\Microsoft\Teams\current\Teams.exe » (PID 18152) a été empêché d'effectuer des appels système à Win32k.sys.

 

It is strange that a Microsoft App dont have right to call their process?!?! Anyone can explain me please?

 

Thanks

    • BMoreOs's avatar
      BMoreOs
      Brass Contributor

      Did you ever find a resolution here? I agree with you and prefer to have it blocked for everything instead of in audit mode because of Teams and Msft products.

      • StevenRPF's avatar
        StevenRPF
        Brass Contributor
        No answer for that from anyone ... that's strange!!!

Resources