Forum Discussion
ASR Exclusions
Hi all, I've been experiencing with ASR exclusions at several clients with same results... 1. Rules in Audit mode, exclusion added but file keep comming back in report for all exclusions... ...
- In this scenario I will recommend you to open a premier ticket . I am 100 sure normal ticket wont help you brother . I am sorry
ASR does not work as expected: exceptions on Windows 10 (Update 10/2023) are simply ignored. On Windows 2019 Server they work, but not on Windows 10.
After wasting a lot of time, I removed all the rules, it makes no sense.
Exceptions are reported to the clients via GPO, also get-mpprefence shows the list correctly, but saving a PS Script from OneNote to the any folder will still be blocked:
Pfad: C:\Users\Test\Downloads\myscript.ps1
Prozessname: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
Event ID 1121
3B576869-A4EC-4529-8536-B80A7769E899
The exception for onenote.exe is ignored.
After removing this ASR rule, everythink works again
it is really annoying
Microsoft should focus on increasing better support for MDE. they are selling a product but there support enginners are unable to resolve it !!!!
- the exceptions work, but not as intended, in order to save scripts etc. in OneNote with ASR activated, you can define a fixed paths on the drive and up- or download this content to/from OneNote (e.g. c:\temp\OneNote). But copy&paste from pther locations simply won't work anymore. Nevertheless, a see lots of errors in the event log with ASR activated, seems not very sophisticated (lsass.exe, msiexec.exe)
