Force custom policy mode

Default Defense+ policy for explorer.exe set to predefined Windows System Application, which allow running any application.
For better security I always set Defense+ policy of explorer.exe to custom policy, because in that mode CIS asks to allow explorer.exe run every application not defined in policy… but user can by mistake switch explorer.exe policy to predefined, so I need to switch back to custom policy. Also in some cases, CIS automatically switch explorer.exe policy to Windows System Application. In other hand user can by mistake set very restrictive Isolated Application policy for explorer.exe – as result Windows will not works properly.

Thus in such cases we need to disable switching explorer.exe (and any other application) policy to predefined as it already made for services.exe in allow/block dialog.

I suggest adding checkbox in Application System Activity Control dialog (Computer Security Policy) Force custom policy mode, which can be checked only then application policy set to Custom or maybe add checkbox Disable policy switching (?)