Forum Discussion
Solved
Antivirus deletes all shortcuts from the desktop
After this morning's update of security intelligence to version 1.381.2140.0, defender is deleting on all clients all links to applications; does anyone have the same problem?
We have the same issue and many more.
https://www.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/
Set the following ASR rule to Audit.
Block Win32 API calls from Office macros
Rule-ID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b
Then you can restore the links. Microsoft needs to fix this ASAP
Has Microsoft made any comment
- Now there is the advisory on Service health in Microsoft365 Admin portal: Some users are unable to utilize the Application shortcuts on the Start menu and taskbar
MO497128, Last updated: January 13, 2023 12:57 PM
Estimated start time: January 13, 2023 12:43 PM
- yeah we are seeing this across multiple orgs too. We are testing the suggested fix
- I modified the rule: Block Win32 API calls from Office macros
from Block to Audit mode
in MDM Security Baseline
category Microsoft Defender- The support team have confirmed this is a known issue from today .. and recommend doing this until the fix. They also tell me that they will get the shortcuts put back.. but we'll see
Dreamaker We haven´t had a block roule, but all shortcuts were deleted. We changed to audit, but without a change on the tested mashines.
- It looks like having a rule set to "Warn" also causes the issue. You need to set to audit or disabled.
