Exploit Protection block Teams call to Win32k.sys

Brass Contributor



Is it normal than almost all PC in our business have this warning in eventviewer :


EventID: 10 Le processus « \Device\HarddiskVolume2\Users\JoeBlo\AppData\Local\Microsoft\Teams\current\Teams.exe » (PID 18152) a été empêché d'effectuer des appels système à Win32k.sys.


It is strange that a Microsoft App dont have right to call their process?!?! Anyone can explain me please?



3 Replies
No Microsoft specialist here can help me about that?

Did you ever find a resolution here? I agree with you and prefer to have it blocked for everything instead of in audit mode because of Teams and Msft products.

No answer for that from anyone ... that's strange!!!