Block Adobe Reader from creating child processes
This `DWORD` value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. Value data 1 enables the rule in Block mode.
The rule prevents Adobe Reader, including the Adobe Acrobat processes covered by the rule, from creating child processes. Consequently, command interpreters, script hosts, and other programs cannot be launched directly as children of a covered Adobe process.
Notes
Additional effects
Microsoft Defender can record blocked operations as ASR events. In Microsoft Defender for Endpoint, the advanced hunting action type associated with a blocked operation is AsrAdobeReaderChildProcessBlocked.
EDR alerts and user notification pop-ups have additional Microsoft Defender Antivirus cloud protection level requirements. These requirements affect alerting and notifications; they do not change the meaning of 1 as Block mode.
Security
The rule restricts an attack path in which a malicious PDF, social engineering, or an Adobe Reader or Acrobat vulnerability is used to launch another program or a malware payload. This reduces an attacker's ability to download or execute additional payloads from a compromised Adobe process.
Its scope is limited to child-process creation by the covered Adobe applications. It is not general application control, does not block processes launched by unrelated applications, and does not remove malware that is already present.
Possible side effects
Legitimate Reader or Acrobat features, extensions, and document-based workflows can be disrupted if they need to launch an external program as a child process. In Block mode, such a launch is prevented even when the requested program is benign.
Notes
This value is an individual rule entry within the device-wide ASR policy and is not user-specific. The rule depends on Microsoft Defender Antivirus and, according to Microsoft, has limited exclusion support.
Microsoft documents support for this rule on Windows 10 version 1809 and later, Windows 11, and supported Windows Server releases. Windows Server 2012 R2 and Windows Server 2016 have additional requirements related to the modern unified Microsoft Defender for Endpoint solution.
Microsoft documentation
Microsoft Learn: Attack surface reduction rules reference
Microsoft Learn: Configure attack surface reduction rules and exclusions