Exploit Protection block Teams call to Win32k.sys

[StevenRPF]

Hi,

Is it normal than almost all PC in our business have this warning in eventviewer :

Microsoft-Windows-Security-Mitigations

EventID: 10 Le processus « \Device\HarddiskVolume2\Users\JoeBlo\AppData\Local\Microsoft\Teams\current\Teams.exe » (PID 18152) a été empêché d'effectuer des appels système à Win32k.sys.

It is strange that a Microsoft App dont have right to call their process?!?! Anyone can explain me please?

Thanks

[#2]

No Microsoft specialist here can help me about that?

[#3]

Did you ever find a resolution here? I agree with you and prefer to have it blocked for everything instead of in audit mode because of Teams and Msft products.

[#4]

No answer for that from anyone ... that's strange!!!