Forum Discussion

cbrd's avatar
cbrd
Copper Contributor
May 23, 2025

Removing attack surface reduction rules not possible

Hi   We have implemented attack surface reduction rules in my company on all windows 10 pc's. We audited for a few months and created exclusions which worked well.   Now we have a new program th...
rahuljindal's avatar
rahuljindal
Bronze Contributor
May 24, 2025

Did you use ConfigMgr to configure the ASR the first time? Just checking, but can you confirm that you don’t have conflicting policies coming from elsewhere like GPO?

  • cbrd's avatar
    cbrd
    Copper Contributor
    May 25, 2025

    Hi, yes we used SCCM to configure it for the first time, and ASR aren't defined in our GPO no.

  • cbrd's avatar
    cbrd
    Copper Contributor
    May 24, 2025

    Hi, yes we did use SCCM to implement it, and we do not have any GPO's with ASR set anywhere. These rules were not configured at all before implementing through SCCM

    • rahuljindal's avatar
      rahuljindal
      Bronze Contributor
      May 27, 2025

      Thanks for the confirmation. Some ASR policies may require a reboot for changes to reflect. Have the devices been rebooted at least once? Maybe run a RSOP on a device in question just to be sure there are no other conflicts. If you have Security baselines containing Defender settings coming from GPO, then that could be taking precedence as well.

  • cbrd's avatar
    cbrd
    Copper Contributor
    May 24, 2025

    Hi, yes we did use SCCM to implement it, and we do not have any GPO's with ASR set anywhere. These rules were not configured at all before implementing through SCCM

Resources