Forum Discussion
Implementing ASR - Block credential stealing
Yes, this is expected. As a default, ASR policies are supposed to be conservative. There are some malicious activities that behaves in a similar way to legitimate activity. Microsoft defaults on the side of caution and alerts on these files. This is not unusual.
I suggest that you add exceptions for necessary Windows files, so you don't encounter a situation where you block critical processes.
The best practice here would be to review these policies on a scheduled basis. Digital environments can change and policies should be reviewed to ensure they are still relevant.
Yes, this is expected. As a default, ASR policies are supposed to be conservative. There are some malicious activities that behaves in a similar way to legitimate activity. Microsoft defaults on the side of caution and alerts on these files. This is not unusual.
I suggest that you add exceptions for necessary Windows files, so you don't encounter a situation where you block critical processes.
The best practice here would be to review these policies on a scheduled basis. Digital environments can change and policies should be reviewed to ensure they are still relevant.
- thanks!.... no problem at all... I review ASR reports regularly so that is not an issue... Was just not expecting it will block regular windows files.... But yea, make sense from security point of view 🙂
will be adding exceptions for them..- Anytime, glad I could help. Could you mark this as the best answer if it fits that description?
