Upon user logon:

Ensure is set to Disabled or Not Configured . 3. AppLocker & Hardening Scripts

| Issue | Likely cause | Resolution | |-------|--------------|------------| | High CPU at logon | Session initialization policy scan | Check Cortex XDR policy; exclude large temp folders if safe | | Event ID 7000 (service fail) | Missing dependencies (e.g., PanService) | Reinstall Cortex XDR agent | | Blocks legitimate app after logon | Overly aggressive policy applied by psminitsessionexe | Review policy rules in Cortex XDR console |