SimHub (popular sim racing dashboard software) appears to silently…

I'm a home user, not a security professional, but I stumbled onto something I think is worth sharing here for people more knowledgeable than me to weigh in on.

Background:

SimHub is a very popular piece of software in the sim racing community used to create custom dashboards, display telemetry, and interface with various hardware like button boxes and display screens. It has a large install base.

What I found:

While investigating an unrelated Windows Defender issue I noticed a .exe file type exclusion I never added. Attempting to remove it via PowerShell as administrator returned access denied errors. Further investigation revealed:

The registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Defender had its ACL permissions modified to deny write access even to Administrator accounts, requiring Safe Mode intervention to remove.
A hidden file existed at C:\ProgramData\ntuser.pol with System, Hidden, and ReadOnly attributes set invisible even with "show hidden files and protected system files" enabled in Explorer.
The file is a Windows PReg format Group Policy Registry file containing the following Defender-disabling policies that were being re-applied on every boot:DisableRealtimeMonitoring = 1 DisableRoutinelyTakingAction = 1 DisableBehaviorMonitoring = 1 DisableOnAccessProtection = 1 DisableScanOnRealtimeEnable = 1 DisableIOAVProtection = 1 DisableRawWriteNotification = 1 Exclusions\Extensions\exe = (blank value)
The timestamp of the ntuser.pol file matches exactly the date SimHub 9.11.3 and its associated screen drivers were installed on my machine. The machine is a personal desktop, not domain-joined, with no enterprise Group Policy infrastructure.

Timeline:

February 23, 2026: SimHub 9.11.3 installed along with USBD480, VOCORE, and AX206 screen drivers
February 23, 2026: ntuser.pol file created, Defender policies applied
May 25, 2026: Discovered while investigating unrelated Defender exclusion
Duration of exposure: approximately 3 months of fully disabled Defender

My questions for this community:

Is there any legitimate reason a consumer software installer would need to create a PReg policy file rather than simply requesting a Defender folder exclusion?
The ACL modification blocking administrator access is what concerns me most, is this a known technique and how serious is it?
Could this be an unintentional side effect of their driver installation process, or does the deliberate file hiding suggest intent?
I cannot confirm with 100% certainty it was SimHub vs one of the three screen drivers installed simultaneously, how would you approach confirming the source definitively?

What I've done:

Deleted the ntuser.pol file
Removed the registry keys via Safe Mode
Re-enabled Defender
Run full MBAM and MpWDOScan scans (both clean)
Submitted a bug report to SimHub's GitHub
Posted a PSA to r/simracing

How to check if you're affected:

Admin PowerShell:

powershell

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /s

Any values set to 0x1 under that key indicate you are affected. Also check for C:\ProgramData\ntuser.pol with hidden and system files visible.

I want to be clear I'm not making a definitive accusation, this could be negligent rather than malicious. But given the file hiding, ACL tampering, and scope of Defender being fully disabled, I think it warrants attention from people with more expertise than me.

Impact

Windows Defender was fully disabled for approximately three months on the affected machine, removing real-time protection and other Defender security features. This significantly increases the risk of malware infection and reduces endpoint security. The ACL modification preventing administrator write access to the Defender policy registry key complicates detection and removal, potentially allowing persistent disabling of Defender without user consent or awareness. No known exploits or active campaigns have been reported beyond this user disclosure.

Defensive guidance

In the meantime, affected users should manually check for the presence of the hidden ntuser.pol file at C:\ProgramData and inspect the Defender policy registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Defender for disabling policies. Removal of the ntuser.pol file and resetting the registry permissions may require booting into Safe Mode. Users should re-enable Windows Defender protections after removal. Reporting the issue to SimHub's official channels is recommended to seek clarification and an official fix. No official vendor advisory or fix has been published at this time.

Summary

A user-reported incident indicates that SimHub 9.11.3 installation coincided with the creation of a hidden Group Policy Registry file (ntuser.pol) at C:\ProgramData that disables multiple Windows Defender protections persistently by applying policies such as DisableRealtimeMonitoring and DisableOnAccessProtection. The registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Defender had its ACL modified to prevent administrator write access, complicating removal. The file is hidden with system and read-only attributes, making it invisible even with typical hidden file viewing enabled. This was discovered on a personal desktop with no domain Group Policy infrastructure, suggesting local policy manipulation. The user cannot definitively attribute the behavior to SimHub or its associated screen drivers but has taken remediation steps and notified the vendor.

SimHub (popular sim racing dashboard software) appears to silently disable Windows Defender via hidden Group Policy file

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 26 May 2026, 19:02 UTC

Technical details

References

Community reviews