Re: PSA: Somehow, without action from me, hyberfile.sys got turned on

On 4/1/2026 1:24 AM, Maria Sophia wrote:
> My theory?
> 
> A Windows servicing stack power-policy reset triggered during a Defender update cycle.
> 
> Can I prove that?
> Nope.
> 
> But since it happened, there must be a mechanism for it to happen.
> It's all I can think of that might do it without the users' knowledge.
> 

For Win10 22H2, Windows Defender updates use the servicing stack but 
that use is only by checking the presence of a Servicing Stack.
For Windows 10 any Serving Stack successfully installed after Sept 2025 
is sufficient for Windows Defender to update its engine and defs. Even 
if ESU has been enabled , the Sept. 25 as a mininum is still sufficient. 
If ESU has been enabled, the most recent monthly cumulative update 
provided by ESU would have installed the latest servicing stack.

Windows Defender's installation of its engine or defs does not instruct 
Windows Update to update the Servicing Stack or cause a power policy reset.

i.e. The hypothesis that a serving stack power policy reset was 
triggered during a Defender update is false.

Something else, user controlled - managed or changed or tampered has 
occurred.


> I'll let you know if hiberfile.sys ever comes back alive again.


-- 
...w¡ñ§±¤ñ