> Source: [sk184891](https://support.checkpoint.com/results/sk/sk184891)

# sk184891 - Endpoint Security Components Do Not Run When ELAM is Disabled

| Property | Value |
|----------|-------|
| Solution ID | sk184891 |
| Date Created | 2026-04-15 |
| Last Modified | 2026-04-17 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | E89.X |

## Symptoms

- * The endpoint boots using Startup Option 8 - Disable Early Launch Anti?Malware (ELAM).
* Endpoint Security components, such as **Firewall** and **Application Control** , show **Not Running**.
* Endpoint security policies are not enforced on the system.

## Cause

When Windows starts with Early Launch Anti?Malware (ELAM) disabled, the operating system blocks the startup of protected security processes.  
Endpoint Security uses ELAM to initialize critical protected services, such as `vsmon.exe` for Firewall enforcement. When ELAM is disabled, Windows prevents these services from starting. As a result, Endpoint Security components cannot run.  
This is an expected behavior and is similar to Windows Safe Mode, where security enforcement is intentionally limited by the operating system.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content