Forum Discussion
ASR - Behavior Changes - Blocking under User Context Now?
- I've so far only managed to check on one endpoint that was having the issue, However it's Security Intelligence Version updated to 1.373.383.0 this morning and it is no longer showing any symptoms of the problem. So early signs are encouraging that this may be fixed.
Has anyone been given an explanation of why this is only affecting a small percentage of identically configured computers?
Windows 10 Settings > Windows Security > Open Windows Security > Click "Check for Updates" under Virus & threat protection updates.
Edit: So far the updated definition
has not helpedwe are now seeing improvements,however it seems like they are still making adjustments.- We considered switching from Block to Audit Only mode but since the number of incidents have vastly reduced and on a downward spiral we will stay in Block mode for now to maintain a balance between security and productivity by resolving any new incidents with file hash rules reactively.
- Thanks. On what sort of cycle will the signatures get updated automatically?
Good to know, i did not get any events in the last hours, but lot people are probably enjoying the weekend already.
To check which version is installed on the computer, run the following Powershell Command:
Get-MpComputerStatus | fl *version*To force an update of the signatures, run the following commands in an elevated command prompt (source: https://www.microsoft.com/en-us/wdsi/defenderupdates😞
cd %ProgramFiles%\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate- I suppose I should know this, but how exactly do you get the updated security intelligence version?
- so for us microsoft replied:
"WDSI Security Intelligence team have gotten back to me and provided the following solution:
We have reviewed the reported issue, and this is known issue
• And regarding ASR issues related to Block executable content from email client and webmail we have provided global fix. The changes will be reflected in the security intelligence version 1.373.181.0 or above. So, we request you to update to the latest security intelligence version and verify the issue. "
so after updating a problem client indeed it changed. we get an all new error message and block event in the defender report.
