Windows 11’s SAFER Turns Not-So-Safe: When Whitelisting Goes Dark!
SAFER on Windows 11 is blocking the execution of system files with its default rule, despite path rules allowing them. Microsoft’s defense in depth? More like defense in daft!
Hot Take:
Looks like Microsoft has a new strategy for Windows 11: “If you can’t hack it, block it!” In a thrilling episode of “Defense in Depth — The Microsoft Way,” our hero, SAFER, decides to take the day off and let chaos reign. So, if you’re planning to open “Windows Security,” you might need the Force. Or maybe just a working version of Windows 10.
Key Points:
- Windows 11’s SAFER feature is mistakenly blocking legitimate applications.
- A default rule is overriding specific path rules in SAFER, causing headaches.
- The issue arises specifically with the SecurityHealthHost.exe in Windows 11 24H2.
- Unprivileged users are hit hardest, unable to open “Windows Security.”
- This is part 93 in a long saga of Microsoft’s security feature misadventures.
Already a member? Log in here