Block untrusted and unsigned processes that run from USB
This computer-scoped registry value controls the Microsoft Defender ASR rule identified by `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
This computer-scoped registry value controls the Microsoft Defender ASR rule identified by b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4. A DWORD value of 1 places the rule in Block mode.
The rule prevents unsigned or untrusted executable files from running from USB removable drives, including SD cards. Examples of covered executable content include .exe, .dll, and .scr files.
Notes
Additional effects
The rule does not prevent affected files from being copied from removable media to a local disk. Microsoft documents that it does, however, block those copied files from subsequently running from the local disk.
Security
The rule reduces the risk of malware being executed directly from removable media or after being copied from that media. It does not disable the USB drive or block every program stored on it: signed or trusted executables are outside the stated blocking criteria. It also does not prevent access to other files on the drive or stop them from being transferred.
Possible side effects
Legitimate portable applications, installers, and other executable components can be blocked when Microsoft Defender does not consider them signed or trusted. This can also affect files that were first copied from a USB drive to local storage.
Notes
This rule is a Microsoft Defender Antivirus feature and depends on Microsoft Defender Antivirus being available. ASR file or folder exclusions can remove exempted objects from the rule's protection.
Microsoft documentation
Microsoft Learn: Attack surface reduction rules reference
Microsoft Learn: Policy CSP – Defender