Forum Discussion
Antivirus deletes all shortcuts from the desktop
After this morning's update of security intelligence to version 1.381.2140.0, defender is deleting on all clients all links to applications; does anyone have the same problem?
We have the same issue and many more.
https://www.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/
Set the following ASR rule to Audit.
Block Win32 API calls from Office macros
Rule-ID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b
Then you can restore the links. Microsoft needs to fix this ASAP
I modified the rule: Block Win32 API calls from Office macros
from Block to Audit mode
in MDM Security Baseline
category Microsoft Defender
from Block to Audit mode
in MDM Security Baseline
category Microsoft Defender
Dreamaker We haven´t had a block roule, but all shortcuts were deleted. We changed to audit, but without a change on the tested mashines.
- Probably you can have this setting in different way: local GPO, ASR rule, Security baseline rule.
- It looks like having a rule set to "Warn" also causes the issue. You need to set to audit or disabled.
- The support team have confirmed this is a known issue from today .. and recommend doing this until the fix. They also tell me that they will get the shortcuts put back.. but we'll see
