Forum Discussion

__John_L_'s avatar
__John_L_
Tin Contributor
Feb 23, 2026

Device Guard

I'm running into an issue running downloaded binaries in a Windows Sandbox. The error indicates that the Device Guard feature is protecting my system. How do I override this protection? Is there an ...
security
GaryGoGoGo's avatar
GaryGoGoGo
Brass Contributor
Jul 30, 2026

I spent a couple annoying hours on this today, 30 July 2026. My guess is that a recent preview update made Device Guard more strict. In theory, Smart App Control can be disabled, then rename the .cip files (policy files for device guard). However, renaming these files requires booting into recovery mode. Then even when I used the BIOS to disable secure boot, I could not restart Windows. I had to restore the .cip file names. I am now running with secure boot and Smart App Control enabled.

My problem was with personal, custom executables that I had scheduled to run from the task scheduler, such as to update my web site with a message of the day. I think I could satisfy Device Guard by signing the EXEs, but I don't want to mess with certificates for these silly little programs. I solved my own problem by placing the EXEs (with required DLLs and such) into folders under "c:\Program Files". For the moment, Device Guard allows these EXEs in this folder.

As for your sandbox, maybe you can find a way to sign your EXEs with free certs. Or maybe your sandbox has its own Program Files folder.