LockAppHost disables Windows Update/malware removal scheduled tasks

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

Detects the use of 'schtasks.exe' to disable critical Windows Update or ExploitGuard Malware Removal tasks when initiated by 'LockAppHost.exe'. This behavior is highly irregular, as the LockAppHost process is typically associated with the Windows Lock Screen and should not be modifying security-related scheduled tasks.