Forum Discussion

djolenole's avatar
djolenole
Brass Contributor
Oct 08, 2025
Solved

ASR rules enabled after onboarding Windows server

Hello, 

I tested onboarding Windows Server 2019 to Defender using local script and noticed that after onboarding some ASR rules are already enabled in Block mode by default:

 

Block Office applications from creating executable content3b576869-a4ec-4529-8536-b80a7769e899
Block execution of potentially obfuscated scripts5beb7efe-fd9a-4556-801d-275e5ffc04cc
Block Office applications from injecting code into other processes75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84
Block Win32 API calls from Office macros92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b
Block credential stealing from the Windows local security authority subsystem (lsass.exe)9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
Block executable content from email client and webmailbe9ba2d9-53ea-4cdc-84e5-9b1eeee46550
Block JavaScript or VBScript from launching downloaded executable contentd3e037e1-3eb8-44c8-a917-57927947596d
Block all Office applications from creating child processesd4f940ab-401b-4efc-aadc-ad5f3c50688a

 

I haven't applied any group policies yet to it. 

The server is domain joined. 

 

Could it happen that it pulls the configuration from another place?

 

Thanks

  • djolenole's avatar
    djolenole
    Oct 14, 2025

    There is one group policy for CIS compliance where we enabled several ASR rules. 

    Thanks!

2 Replies

  • rahuljindal's avatar
    rahuljindal
    Bronze Contributor
    Oct 08, 2025

    Where are you checking for the settings? Can you run rsop to be sure?

    • djolenole's avatar
      djolenole
      Brass Contributor
      Oct 14, 2025

      There is one group policy for CIS compliance where we enabled several ASR rules. 

      Thanks!

Resources