| The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce "Good, unknown and bad but critical" (preventing "bad"). |
If the registry value name below does not exist, this is a finding.
If it exists and is configured with a value of "7", this is a finding.
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\
Value Name: DriverLoadPolicy
Value Type: REG_DWORD
Value: 1, 3, or 8
Possible values for this setting are:
8 - Good only
1 - Good and unknown
3 - Good, unknown and bad but critical
7 - All (which includes "Bad" and would be a finding)