Start::
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
GroupPolicy: Restriction ? 
Policies: C:\ProgramData\NTUSER.pol: Restriction 
EmptyTemp:
End::