Man these ghost CLSID from ealrier user accounts are a real pain in the ass. Found a page for possible solution (i ran it literally a few seconds ago and still have to restart my pc. Eventview looked OK though....
there should be A BIG BARRIER PRIOR re-installing microsoft for this high-class-amature-nonsense!
POSSIBLE(!) solution (i'm a real noob so I dont know wether this will actually will fix your(also my) problem
[EASY STEPS a 3 year old can do these]
link: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules or search google "Microsoft recommended driver block rules"
our focus will be at 2 /3 of the page titled:
"Steps to download and apply the vulnerable driver blocklist binary"
there's two links which you will need in step 2 and the other 3
2)https://aka.ms/refreshpolicy
3)https://aka.ms/VulnerableDriverBlockList
walk trough the two 1 t/m 5 steps on that page, for a bit help doing those steps here's mine for a full step by step:
- find some info
start CMD and echo you cpu, type: "echo %processor_architecture% (mine was AMD64 while having i7-intel, but since AMD was the first with these cpu and companies choose to not change this, just ignore it if your situation is the same) - visit the link as mentioned above
than download your version (echo step 1) should be one of these 3
RefreshPolicy(X86).exe RefreshPolicy(AMD64).exe RefreshPolicy(ARM64).exe - Download and extract the vulnerable driver blocklist binaries
- Select (unpack, I choose audit here cause i had some trouble with enforced in the past. No clue if it matters) either the audit only version or the enforced version and >>>>>>>>> rename the file to SiPolicy.p7b
- Copy SiPolicy.p7b to %windir%\system32\CodeIntegrity
- Run the WDAC policy refresh tool you downloaded in Step 1 above to activate and refresh all WDAC policies on your computer (you wont see a single .... this happens to be normal so don't panic)
- chech the event viewer, mine had one 3099 with this information: Refreshed and activated Code Integrity policy {a244370e-44c9-4c06-b551-f6016e563076} Microsoft Windows Driver Policy - Audit. id 10.0.25310.0. Status 0x0
- so, that's that. I'm going to restart now and I hope it works out! (probably to lazy to confirm later on but who knows)
steps for event viewer:
To check that the policy was successfully applied on your computer:
- Open Event Viewer
- Browse to Applications and Services Logs - Microsoft - Windows - CodeIntegrity - Operational
- Select Filter Current Log...
- Replace "<All Event IDs>" with "3099" and select OK.
- Look for a 3099 event where the PolicyNameBuffer and PolicyIdBuffer match the Name and Id PolicyInfo settings found at the bottom of the blocklist WDAC Policy XML in this article. NOTE: Your computer may have more than one 3099 event if other WDAC policies are also present. Hope this helps US out!
peace
MJ