ASR Exclusions

[Francois_Papillon]

Hi all,

I've been experiencing with ASR exclusions at several clients with same results...

1. Rules in Audit mode, exclusion added but file keep comming back in report for all exclusions...

2. Using Get-MpPreference on endpoint do not show any exclusion at all

Endpoints are W10/11 22h2

My questions are

1. Do exclusions only get pushed to endpoint on block mode?

2. Exclusions are being added to the asr policy, do i need to set them some place else? GPO?

3. If I create a audit policy and a block policy with different group assignment,  setting same exclusions in both.  Moving endpoint from the audit group to the block group. Will this work?  Ive been told only one asr policy can be in place audit or block....

4. Per rule exclusions,  ive been told not to use... not working...  is this true?

Thank you

[#2]

It would be great to have an answer from Microsoft about ASR.
It seems that ASR doesn’t work as it should.
We have done several tests and sometime exclusions do not apply, sometimes, Block/Audit configuration doesn’t apply.

[#3]

Really no one are using ASR exclusions? Microsoft ?

[#4]

You can run ASR as audit mode or block mode. But its better to run in audit mode first. Audit mode lets you see a record of what would have happened if you had enabled the feature. You can also get an idea of how many suspicious file modification attempts occur over a certain period of time. The features won't block or prevent apps, scripts, or files from being modified.
Please do not forget to mark helpful if you find my comment helpful

[#5]

Allready running in audit mode, but audit or block, exceptions never get to endpoints and every exceptions will still show up in the list... exceptions simply dont work at all, I got over 10 clients in the excact same position. ASR is unusable without exceptions

[#6]

I think ASR works better with intune . I have deployed ASR exclutions for some devices which are managed by intune and I had better experience .
NB : Intune devices were enrolled with autopilote as many feature will not work based on which why you have enrolled your devices . same rule didnt worked for teh devices which are managed by local AD . you can give it a try

[#7]

Maybe it was onclear in my first post, all endpoints are onboard to intune all asr excpetions are set through intune, using provided csv or manually with wildcards...

enpoints are hybrid ad joined and co-managed with workload in intune, no exploit guard setting in mecm in the past

using powershell command Get-MPPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids & AttackSurfaceReductionRules_Actions we can see wich rules are configured and set to block mode

Get-MpPreference | select AttackSurfaceReductionOnlyExclusions never show any exclusions in audit nor in block mode on the endpoint... this is the issue

Using Set-MpPreference -AttackSurfaceReductionOnlyExclusions will work partially... will show in the previous command but the excluded item still show up in the intune report... so not excluded from my point of view

[#8 · Accepted solution]

In this scenario I will recommend you to open a premier ticket . I am 100 sure normal ticket wont help you brother . I am sorry

[#9]

I now have a client who got it fixed from microsoft premier ticket but microsoft will not supply the resolution information... apperently its on their side and wont say why its broken in first place...

[#10]

I agree . this is there back end issue . but definitely we need more people like you who bring this issues Infront so Microsoft will take this things seriously. Best of luck brother

[#11]

ASR does not work as expected: exceptions on Windows 10 (Update 10/2023) are simply ignored. On Windows 2019 Server they work, but not on Windows 10.

After wasting a lot of time, I removed all the rules, it makes no sense.

Exceptions are reported to the clients via GPO, also get-mpprefence shows the list correctly, but saving a PS Script from OneNote to the any folder will still be blocked:

Pfad: C:\Users\Test\Downloads\myscript.ps1
Prozessname: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

Event ID 1121

3B576869-A4EC-4529-8536-B80A7769E899

The exception for onenote.exe is ignored.

After removing this ASR rule, everythink works again

it is really annoying

[#12]

Microsoft should focus on increasing better support for MDE. they are selling a product but there support enginners are unable to resolve it !!!!

[#13]

the exceptions work, but not as intended, in order to save scripts etc. in OneNote with ASR activated, you can define a fixed paths on the drive and up- or download this content to/from OneNote (e.g. c:\temp\OneNote). But copy&paste from pther locations simply won't work anymore. Nevertheless, a see lots of errors in the event log with ASR activated, seems not very sophisticated (lsass.exe, msiexec.exe)