Well... that is a good question...

I was about to try that on a laptop just to see what happens... But as you pointed out, if the service can't start CSA... then CSA couldn't apply the rules...

But then again... would the system start CSA but stop everything else from starting after CSA started once the rules are applied?

Anyway, the answer to your second question: Booting into safe mode has not been disabled.

Which brings me back to my question: What would be the most effect method to disable a system?

Or is booting into SafeMode allows the bypassing all of the CSA rules?

I guess you should determine why you are doing this before you choose a what and how.

If you simply want to disable a system to protect other systems, the network quarantine feature should work.

If you want to make it so a system that triggers certain rules should be disabled so that no changes can be made to it, there are ways to do that too.

You would still be able to return system to a functioning state from the MC without reimaging it.

CSA needs the system functioning in order to be effective at enforcing rules.

Booting into safe mode will bypass CSA but there are ways to disable that as well.

Tom