What does SAU(Script As Updater) do

INFO: What does SAU do?
Just wanted to post some info about SAU, in case others had any concerns about what it does and what it's for.
Please don't confuse the SAU feature with the SCRIPT-AUTH feature (especially when looking at 'sadmin feature list' output).  These are two different modules.  
SAU (Script as Updater) feature injects AppControl code into other memory processes to obtain the command line and determine if the script being executed is an updated or not.  
(KB89466) Script as Updater is needed if a script file has to modify a solidified system. It requires patching of the ntdll.dll that is loaded in an Interpreter process. The patching is required to hook a function that notifies MACC when a script is being run and check the updater rule configured for it. The patching of ntdll.dll makes it vulnerable to issues. As of now, a Script as Updater bypass does not exist. Script as Updater should be injected only in script interpreters' processes, not all processes. When applying an Application Control key while MP is disabled, scinject.dll is injected only in script interpreters. The same logic exists for the Execution Control feature, which needs to hook the same functions as Script as Updater is hooking.  
To change SAU states (Enabled <-> Disabled), a system reboot IS required.  
With Solidcore Application and Change Control (MACC) 8.0.2 and higher, SAU (and Memory Protection (MP)) can be permanently disabled on clients during product enabling/activation; see KB90732 for details.  
With the MACC 8.0.2 and higher extension, the SAU feature is manageable via ePO policy and reportable in Agent node properties. 
With previous versions it is not and must be enabled/disabled via a SC:RunCommand client task from ePO or via local cmd prompt on the MACC client (see KB89466).
 

By Tankink, Kary.