| Previous | Next |
| STATUS_NOT_SAFE_MODE_DRIVER | STATUS_ACCESS_DISABLED_BY_POLICY_PATH |
STATUS_ACCESS_DISABLED_BY_POLICY_DEFAULT
The file was blocked by the policy default rather than a specific exception
SRP evaluates executable identity and rules, then falls back to the configured default level when no higher-precedence rule authorizes it. This status therefore points to the baseline policy decision, not necessarily a path, hash, certificate, or zone rule.
Collect the effective SRP policy, evaluated file identity, user scope, and rule precedence. Do not rename or relocate the file before recording evidence. The correct change is usually a narrowly scoped allow rule or a corrected deployment location, not disabling the default protection.
What to inspect
- Capture file hash, signer, original path, user, and effective policy level.
- Check whether any explicit rule matched before the default was used.
- Create the smallest justified exception and test it under the affected user token.
References
- Microsoft: Software Restriction Policies
- Microsoft: SaferIdentifyLevel
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.