> OK. You literally said: Yes, and I didn't call it a "kernel rootkit" as you said I did. > How would a signature system would have prevented a malware that w

> OK. You literally said: Yes, and I didn't call it a "kernel rootkit" as you said I did. > How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ? Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.