Attack surface reduction rule triggers a mess on Friday the 13 @ AskWoody

Attack surface reduction rule triggers a mess on Friday the 13

Posted on January 13, 2023 at 09:00 CST by Susan Bradley • Comment in the Forums

#Fridaythethirteenthmess

Microsoft 365 Status on Twitter: “The revert is in progress and may take several hours to complete. We recommend placing the offending ASR rule into Audit Mode to prevent further impact until the deployment has completed. For more details and instructions, please follow the SI MO497128 in your admin center.” / Twitter

If you set up the Attack surface reduction rule to check Office macros, you have woken up to missing shortcuts. It appears to have been triggered after a defender update. Note this will only occur IF you have attack surface reduction rule enabled. On machines where this is not set, no issues will be seen using Defender. It is just those with ASR rules enabled.

The specific rule causing this is

Block Win32 API calls from Office macros

Rule-ID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b

In Intune or group policy set the rule to audit if Microsoft hasn’t done it for you already. Now how to deal with the missing shortcuts?

Emin reports that “If you’ve volume shadow copy enabled, you can find these shorcuts in a VSS snapshot. I still use nowadays this code whenever I’ve to mount/dismount VSS snapshots. https://p0w3rsh3ll.wordpress.com/2014/06/21/mount-and-dismount-volume-shadow-copies/

Alternatively you can get the shortcuts from Onedrive if the Desktop synchronization was enabled.

Microsoft’s guidance here:

I’ll also note this on the Master Patch list – but it’s NOT exactly patch related side effect.

Windows Patches/Security Master Patch List, Patch Lady Posts

Plus Membership

Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.

AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.

Welcome to our unique respite from the madness.

It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.

S	M	T	W	T	F	S
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30

Attack surface reduction rule triggers a mess on Friday the 13

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

Key Links

Attack surface reduction rule triggers a mess on Friday the 13

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

Login and Registration

Key Links