You have a Windows host on your network in Reduced functionality mode (RFM). While the system is in RFM, which of the following is TRUE?
You have a Windows host on your network in Reduced functionality mode (RFM). While the system is in RFM, which of the following is TRUE?
When a Windows host is in Reduced Functionality Mode (RFM), some detection patterns and preventions will not be triggered. This is a designed behavior to ensure minimal functionality and to prompt resolution of the underlying issue causing RFM without completely compromising the security posture.
D is the correct answer.
D is the correct. Like verified also by CrowdStrike support, some detection like for example privilege escalation will not be triggered but only logged.
D is correct, found in the docs