I've been running some reg/file snapshot utilities, in order to find out how XPlite disables WFP "On the fly" (No restart neccesary) the way it does, but haven't been able to figure it out? What's most impressive/confusing is the fact that sfc_os.dll and the other sfc files aren't touched either. Simply replicating the added registry entries created by XPlite doesn't work. There's something else, BUT WHAT ? If there's a similar smaller utility that does this on SP3, preferrably one that can be scripted in command line, i would like to know about it. Not interested in ones that changes systemfiles, as i assume XPlite doesn't. Any suggestions ?