Configure Attack Surface Reduction rules

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ExploitGuard_ASR_Rules
• HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\<ASR rule GUID>

This machine policy sets the operating mode of individual attack surface reduction (ASR) rules. ASR rules are a Microsoft Defender Antivirus feature that detects specific risky behaviors commonly associated with malware and intrusion activity. The behavior covered by each entry is determined by the rule identified by its GUID.

The ExploitGuard_ASR_Rules value indicates that the ADMX policy is enabled. Individual rule states are stored as values under the Rules subkey, with each ASR rule GUID used as a value name. The defined value data is:

• 0 – Off: The rule is explicitly disabled.
• 1 – Block: The rule prevents activity that matches its conditions.
• 2 – Audit: Detections are recorded, but the activity isn't prevented.
• 5 – Not configured: The rule isn't explicitly enabled. This is functionally equivalent to Off, but has different policy-conflict semantics.
• 6 – Warn: The rule initially blocks the activity and permits a temporary override when the rule and the installed Windows and Defender versions support this mode.

When the policy itself is disabled or not configured, it doesn't configure any ASR rules.

Notes

Additional effects

Audit detections and blocked actions can be recorded in Windows events and, with the appropriate Defender for Endpoint integration, can appear in reports, alerts, and advanced hunting data. Windows can also display a device notification when a rule in Block or Warn mode is triggered.

The setting affects only the rules whose GUIDs are present. It doesn't automatically enable every available ASR rule or rules introduced later.

Security

Rules operating in Block mode reduce the attack surface by preventing the specific behaviors they cover, such as certain process launches, script activity, code injection, or abuse of trusted applications. The resulting protection depends on the individual rules selected.

Audit mode supplies detection information but doesn't stop the detected activity. A value of 0 explicitly disables the corresponding protection rule. A value of 5 also leaves the rule inactive, but differs from an explicit Off state when conflicting policies are resolved.

Warn mode permits a block to be overridden temporarily. Current Microsoft Defender platform versions require administrator approval for this override. Some ASR rules don't support Warn mode.

Possible side effects

ASR rules evaluate behavior rather than only identifying known malware. Legitimate line-of-business applications, Office automation, scripts, or administration tools can therefore perform actions that a rule in Block or Warn mode detects. Depending on the selected rule, this can prevent process creation, macro operations, script execution, or other application functions.

The type and extent of compatibility effects depend on the configured rule GUIDs and the applications used on the device. Audit mode records matching activity without blocking it.

Notes

For ASR rules to be enforced, Microsoft Defender Antivirus must be enabled as the primary antivirus application and running in Active mode. Real-time protection must also be enabled. Some rules and their notification or warning features have additional requirements involving the operating system, Defender platform, cloud-delivered protection, or supported applications.

Microsoft documents this device-scoped policy mapping for Windows 10 version 1709 and later. Support for individual rules varies between Windows and Windows Server releases. Older Group Policy templates might use “Windows Defender Antivirus” instead of “Microsoft Defender Antivirus” in the category path; both names refer to the same policy location.

Microsoft documentation

Microsoft Learn: Configure ASR rules and exclusions

Microsoft Learn: Defender Policy CSP – AttackSurfaceReductionRules

Microsoft Learn: Attack surface reduction rules overview

See also

• Entry in the reference