Event banner
Event details
I have a question about actions being blocked by ASR rules. The UI is horrible. "Action Blocked. Your Administrator caused Windows Security to block this action. Contact your help desk".
- what action was blocked?
- what part of 'Windows security' blocked it? Why?
- what Administrator?
With none of that info available, you can imagine how effective the 'help desk' will be resolving it.
- SteveThomas
Microsoft
This is good feedback. Usually, the messages related to security are kept this way for the very purpose of security itself. If this is something that occurred in error, the helpdesk folks can leverage the diagnostic and troubleshooting capabilities. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-asr?view=o365-worldwide#collect-diagnostic-data-for-file-submissions - Are there any plans to either improve the default UI, or allow us to customise the information reported??
