Malicious Removal Tool (MRT) Blocked by System Administrator

Issue Solved. Found previous post from 'Brink' with solution.

Neil Macready said:

Issue Solved. Found previous post from 'Brink' with solution.

Could you please send me the link?

pierre1 said:

Could you please send me the link?

Software restriction policies are stored in the registry keys below. You might check to see if it may be listed in either. If so, delete it and restart the PC to apply.

How Software Restriction Policies Work: Group Policy

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Window

Neil Macready said:

Software restriction policies are stored in the registry keys below. You might check to see if it may be listed in either. If so, delete it and restart the PC to apply.

How Software Restriction Policies Work: Group Policy

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Window

Thank you, I'll try that

I'll add to this thread as this seemed to be the best way to deal with the issue, I have 4 Win 10 devices, all now on Creators edition 2017-08 Cumulative Update for Windows 10 Version 1703 (KB4034674) and have had different solutions to the same issue of the Admin blocking MRT

(1). Asus Zenbook (64 bit) and (2) Cheap Win Tablet(32 bit) - Issue disappeared with update above (MRT now not blocked)
(3) Compaq 3230 Core 2 Duo Laptop (64bit) (Win 8.0-8.1-10 upgrades) registry keys as described above found and deleted (MRT now not blocked)
(4) Current desktop (32 bit) (Sandy Bridge i5 2500) Win 7 to 10 upgrade now on Creators 1703, no mention of MRT or keys in Brinks suggested locations and still blocked by the Administrator (who I am).

I've added the 32-bit and 64bit descriptions as KB4034674 comes in both flavours. I've not tried nuking the policies registry on my desktop as I'm not confident with RegEdit and that that I might inadvertently do damage. Has anybody seen issue 4 and have they managed to solve it?

VicdeB said:

I'll add to this thread as this seemed to be the best way to deal with the issue, I have 4 Win 10 devices, all now on Creators edition 2017-08 Cumulative Update for Windows 10 Version 1703 (KB4034674) and have had different solutions to the same issue of the Admin blocking MRT

(1). Asus Zenbook (64 bit) and (2) Cheap Win Tablet(32 bit) - Issue disappeared with update above (MRT now not blocked)
(3) Compaq 3230 Core 2 Duo Laptop (64bit) (Win 8.0-8.1-10 upgrades) registry keys as described above found and deleted (MRT now not blocked)
(4) Current desktop (32 bit) (Sandy Bridge i5 2500) Win 7 to 10 upgrade now on Creators 1703, no mention of MRT or keys in Brinks suggested locations and still blocked by the Administrator (who I am).

I've added the 32-bit and 64bit descriptions as KB4034674 comes in both flavours. I've not tried nuking the policies registry on my desktop as I'm not confident with RegEdit and that that I might inadvertently do damage. Has anybody seen issue 4 and have they managed to solve it?

Hi VicdeB

Sorry I'm not sure what's going on with your issue number 4. I'll have to leave that to someone here who has more expertise in this area than I do. BTW though, have you downloaded the August edition of MRT through Windows Update and I'm assuming MRT does appear in your C:\Windows\System32 Folder?

Cheers, Neil.

Thanks Neil,
I was hoping that someone who helped you could help me but you might have helped me, yes MRT is in the folder as a 9th August 2017 application file. I note also that there is an MRT folder and in it there is a folder named 677022D4-7EC2-4F65-A906-10FD5BBCB34C, I need to look at my registry again to see if that's in either of the HK_Local or User entries under Policies. Might be a while as I have another problem with my desktop after yesterday's Nvidia update to Driver.385.28, the dreaded Bad Pool caller blue screen of death, if it happens again, I'll probably need to do a roll back and hope for stability before playing with MRT (sigh!). My fault I suppose, built this computer in 2010, it started with Win 7 Pro and has been updated to the very current Win 10 in all the steps since the free upgrade in July 2016, it also runs a few programmes on XP virtualisation and runs a Wacom ET-04050 tablet off an RS-232 connector (great to find on a 2010 LGA-1155 board) .This year the graphics card (Asus 6850) blew up and I went for a NVidia 1050Ti but have had issues
with driver problems on both with every OS upgrade. It looks as though MRT will have to wait and we're also expecting the Fall update later this year, which is a features update so no idea what else will stop working. I guess my Registry is carrying a whole load of gumpf from 2010 and MRT usability might be an issue because of this. I will keep you informed of the out come for interest (assuming no more blue screens)

UPDATE

From another solution, these registry settings weren't available to delete

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f
reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f
reg delete "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f
reg delete "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /

I could not find the MRT folder mentioned in my previous post, so to reiterate Brink's solution that worked for Neal and for me on Win 10 machine Nr 3, has been the best solution so far but not applicable to my desktop.

Neil Macready said:

Issue Solved. Found previous post from 'Brink' with solution.

pierre1 said:

Could you please send me the link?

Probably this tutorial.

Bypass This app has been blocked for your protection in Windows 10