WDAC Policy Deployment / EDR Kill

An adversary with administrative access on a Windows 10 or Windows 11 host may abuse an App Control (formerly WDAC) policy to prevent selected endpoint security components from initializing, reducing host telemetry. Beazley Security documented this behavior in an incident-response investigation; the effect depends on Windows build, policy content, and EDR product and does not mean every EDR product is disabled.