When the current license expires, the following limitations are applied to the functional components:
All tasks are stopped, except the Real-Time File Protection, On-Demand Scan and Application Integrity Control tasks.
You cannot start any tasks except the Real-Time File Protection, On-Demand Scan and Application Integrity Control. These tasks continue to run using the old anti-virus databases.
Exploit Prevention functionality is limited:
Processes are protected until they are restarted.
New processes cannot be added to the protection scope.
Other functions (repositories, logs, diagnostic information) are still available.