CIS/CFP Config security problem, If Defense+ is inactive/disabled (no Registry Keys Protect)
HKEY_LOCAL_MACHINE\SYSTEM\Software
Everyone Full Control permissions of Registry Keys. Guests and Users Groups also can modify the CIS/CFP Config.
Please change Config permissions to
Full Control for Administrators Group.
Full Control for System Group.
Read only for everyone.