Microsoft Tech Community Live:  Microsoft Teams Edition
November 09, 2021, 08:00 AM - 12:00 PM (PST)

Exploit Protection block Teams call to Win32k.sys

%3CLINGO-SUB%20id%3D%22lingo-sub-2846017%22%20slang%3D%22en-US%22%3EExploit%20Protection%20block%20Teams%20call%20to%20Win32k.sys%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2846017%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20normal%20than%20almost%20all%20PC%20in%20our%20business%20have%20this%20warning%20in%20eventviewer%20%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CDIV%20class%3D%22%22%3E%3CSPAN%3EMicrosoft-Windows-Security-Mitigations%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FTD%3E%3CTD%3E%3CDIV%20class%3D%22%22%3E%3CSPAN%3EEventID%3A%2010%20Le%20processus%20%C2%AB%26nbsp%3B%5CDevice%5CHarddiskVolume2%5CUsers%5CJoeBlo%5CAppData%5CLocal%5CMicrosoft%5CTeams%5Ccurrent%5CTeams.exe%26nbsp%3B%C2%BB%20(PID%2018152)%20a%20%C3%A9t%C3%A9%20emp%C3%AAch%C3%A9%20d'effectuer%20des%20appels%20syst%C3%A8me%20%C3%A0%20Win32k.sys.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20strange%20that%20a%20Microsoft%20App%20dont%20have%20right%20to%20call%20their%20process%3F!%3F!%20Anyone%20can%20explain%20me%20please%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2846017%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdministrator%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECommunity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

Hi,

 

Is it normal than almost all PC in our business have this warning in eventviewer :

 

Microsoft-Windows-Security-Mitigations
EventID: 10 Le processus « \Device\HarddiskVolume2\Users\JoeBlo\AppData\Local\Microsoft\Teams\current\Teams.exe » (PID 18152) a été empêché d'effectuer des appels système à Win32k.sys.

 

It is strange that a Microsoft App dont have right to call their process?!?! Anyone can explain me please?

 

Thanks

1 Reply
No Microsoft specialist here can help me about that?