>Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges? Sure, just dump the security to

>Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges? Sure, just dump the security token for MsMpEng.exe. Here it is: https://pastebin.com/ukMPUWA7 https://pastebin.com/ukMPUWA7 IntegrityLevelIndex is 01, MandatoryPolicy is 0x3 , Privs are a subset of the full list. https://www.nirsoft.net/kernel_struct/vista/TOKEN.html https://www.nirsoft.net/kernel_struct/vista/TOKEN.html https://msdn.microsoft.com/en-us/library/windows/desktop/bb530716(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/bb5... https://msdn.microsoft.com/en-us/library/windows/desktop/bb394728(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/bb3... https://msdn.microsoft.com/en-us/library/bb625963.aspx https://msdn.microsoft.com/en-us/library/bb625963.aspx