a9b5b413-0fc5-49c2-ab77-6761b329950c
Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.
To fix this edit GPO: Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected.
STIG: Server: https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93249
Desktop: https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220813