I'm a home user, not a security professional, but I stumbled onto something I think is worth sharing here for people more knowledgeable than me to weigh in on.

Background:

SimHub is a very popular piece of software in the sim racing community used to create custom dashboards, display telemetry, and interface with various hardware like button boxes and display screens. It has a large install base.

What I found:

While investigating an unrelated Windows Defender issue I noticed a .exe file type exclusion I never added. Attempting to remove it via PowerShell as administrator returned access denied errors. Further investigation revealed:

1. The registry key HKLM\SOFTWARE\Policies\Microsoft\Windows Defender had its ACL permissions modified to deny write access even to Administrator accounts, requiring Safe Mode intervention to remove.
2. A hidden file existed at C:\ProgramData\ntuser.pol with System, Hidden, and ReadOnly attributes set invisible even with "show hidden files and protected system files" enabled in Explorer.
3. The file is a Windows PReg format Group Policy Registry file containing the following Defender-disabling policies that were being re-applied on every boot:DisableRealtimeMonitoring = 1 DisableRoutinelyTakingAction = 1 DisableBehaviorMonitoring = 1 DisableOnAccessProtection = 1 DisableScanOnRealtimeEnable = 1 DisableIOAVProtection = 1 DisableRawWriteNotification = 1 Exclusions\Extensions\exe = (blank value)
4. The timestamp of the ntuser.pol file matches exactly the date SimHub 9.11.3 and its associated screen drivers were installed on my machine. The machine is a personal desktop, not domain-joined, with no enterprise Group Policy infrastructure.

Timeline:

• February 23, 2026: SimHub 9.11.3 installed along with USBD480, VOCORE, and AX206 screen drivers
• February 23, 2026: ntuser.pol file created, Defender policies applied
• May 25, 2026: Discovered while investigating unrelated Defender exclusion
• Duration of exposure: approximately 3 months of fully disabled Defender

My questions for this community:

• Is there any legitimate reason a consumer software installer would need to create a PReg policy file rather than simply requesting a Defender folder exclusion?
• The ACL modification blocking administrator access is what concerns me most, is this a known technique and how serious is it?
• Could this be an unintentional side effect of their driver installation process, or does the deliberate file hiding suggest intent?
• I cannot confirm with 100% certainty it was SimHub vs one of the three screen drivers installed simultaneously, how would you approach confirming the source definitively?

What I've done:

• Deleted the ntuser.pol file
• Removed the registry keys via Safe Mode
• Re-enabled Defender
• Run full MBAM and MpWDOScan scans (both clean)
• Submitted a bug report to SimHub's GitHub
• Posted a PSA to r/simracing

How to check if you're affected:

Admin PowerShell:

powershell

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /s 

Any values set to 0x1 under that key indicate you are affected. Also check for C:\ProgramData\ntuser.pol with hidden and system files visible.

I want to be clear I'm not making a definitive accusation, this could be negligent rather than malicious. But given the file hiding, ACL tampering, and scope of Defender being fully disabled, I think it warrants attention from people with more expertise than me.