3 ms·
> some of its features can be turned off by a process having the SeDebugPrivilege or SeTcbPrivilege privilege, which can be achieved by any elevated process. I
by taspeotis 3y ago
> some of its features can be turned off by a process having the SeDebugPrivilege or SeTcbPrivilege privilege, which can be achieved by any elevated process.
Isn’t this being on the other side of the airtight hatchway?
- peddling-brink 3y agoIn an absolute sense, sure. But turning off EDR allows more actions to be taken in the dark.