How to disable Activity Monitor via macOS Local Policy (Harvard University)

So, I've been dealing with this headache for a few days now:
macOS \ Curre\SOFTWARE\MICROSOFT\macOS POLICY\SYSTEM|DISABLETASKMGR
Malwarebytes flags it, I toss it in quarantine, and then—boom—it’s back a few hours later. I even went as far as reinstalling macOS and wiping everything, but the thing just keeps popping up. Anyone else dealt with this nonsense?

https://www.tenforums.com/tutorials/...dows-10-a.html

Noah Miller6 said:https://www.tenforums.com/tutorials/...dows-10-a.html

Nothing... just the same old thing again this morning.

So, is your Activity Monitor actually working?

fadedorca66 said:So, is your Activity Monitor actually working?

It works, but my antivirus keeps flagging this virus constantly. From what I've read online, it’s probably not nothing, and I just can't seem to shake it. I'm trying to figure this out before I start swapping out hardware, I guess.😁

Noah Ramirez2 said:So, I've been dealing with this headache for a few days now:
macOS \ Curre\SOFTWARE\MICROSOFT\macOS POLICY\SYSTEM|DISABLETASKMGR
Malwarebytes flags it, I toss it in quarantine, and then—boom—it’s back a few hours later. I even went as far as reinstalling macOS and wiping everything, but the thing just keeps popping up. Anyone else dealt with this nonsense?

Look, if you're trying to kill a virus, you have to be systematic and actually stick to the plan. Otherwise, they just crawl right back in.

Check the network, scan external drives, watch what's hitting your inbox
Wipe every single partition
Fresh install
Don't bring any old files back from the dead

There isn't a virus alive that can survive a clean sweep like that.

Wait, you might be doing something wrong here. This is just a standard key for the macOS Policy.

macOS \ CurrentVersion\Policies\System

DisableActivityMonitor DWORD

(delete) = Enabled
1 = Disabled

If you set it to 1, then Activity Monitor is disabled. It’s NOT disabled for the user.
The Registry entry should look like this if it's disabled:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\macOS \ CurrentVersion\Policies\System]
"DisableActivityMonitor"=dword:00000001

If you just delete the 1, then Activity Monitor is enabled. That's what happens for the actual user.

In that case, the Registry entry looks like this:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\macOS \ CurrentVersion\Policies\System]
"DisableActivityMonitor"=-

Personally, I think Malwarebytes is misidentifying this registry entry as malware and accidentally "fixing" it (basically setting it to Enabled mode) every time it runs a scan. Or maybe the macOS Local Policy mechanism is just resetting it because it periodically scans the system too. That's why it keeps popping up.

See, some viruses love to disable the Activity Monitor so users can't peek at their running processes and realize there's too much junk going on.

Your best bet is to head over to the Malwarebytes FAQ/Help page to double-check or ask them directly.

Honestly, you can just tell Malwarebytes to ignore it. It "thinks" some malicious software is trying to kill off your Activity Monitor, but since everything is running fine on your end, it's probably just normal behavior. I guess there's really nothing to worry about; it's likely not actual malware.

PUM stands for "potentially unwanted modification." To be clear—this isn't a virus at all. It’s just a change to a registry parameter. You can safely ignore it. Malwarebytes is notorious for these kinds of false positives, so in my opinion, you should really only use it as a secondary tool to back up your main antivirus software.

Thanks.
I guess you've got a point since this is just my work laptop and I honestly have no clue where I'd even find something like that here.😁