Microsoft Defender blocked by enforced App Control policy

Rainer Talosig 0 Reputation points
2026-10-11T14:39:21.15+00:00

Hello, I need help fixing Microsoft Defender on my personal Windows 11 Pro 25H2 laptop.

Windows Defender is not running, and protection updates fail with error 800106ba. Starting the WinDefend service fails.

Code Integrity Event ID 3077 shows that the enforced App Control policy below blocks Defender components:

Policy name: AllowMicrosoft_2025-05-04

Policy ID: a244370e-44c9-4c06-b551-f6016e563076

CiTool reports IsEnforced=True, IsSignedPolicy=False, and IsOnDisk=True.

I did not intentionally configure App Control or install a security policy. In Group Policy Editor, Deploy App Control for Business and Turn On Virtualization Based Security are both Not Configured. I also tried the Windows Update repair/reinstall option, but Defender still does not run.

How can I safely identify the source of this policy and restore Microsoft Defender without deleting my personal files or weakening other Windows security protections?

Thank you.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rauh, Alexander 330 Reputation points
    2026-10-13T21:14:57.7033333+00:00

    Hello Rainer,

    The ID a244370e-44c9-4c06-b551-f6016e563076 is a reserved ID from an older Single policy format so the policy can sit in four places: SiPolicy.p7b and {A244370E-…}.cip under C:\Windows\System32\CodeIntegrity (the .cip in CiPolicies\Active) and the same two files on the EFI partition.

    Since it is unsigned you can delete those files as an admin and restart.

    Can you check if you accidentally connected your Device to a Work or School account? (go here: Settings -> Accounts -> Access work or School) if it is coming back we need to check a bit more

    Best Regards Alex

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.