You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/enable-attack-surface-reduction.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -159,7 +159,7 @@ The following procedures for enabling attack surface reduction rules include ins
159
159
160
160
1. Select **Device configuration** > **Profiles**. Choose an existing endpoint protection profile or create a new one. To create a new one, select **Create profile** and enter information for this profile. For **Profile type**, select **Endpoint protection**. If you've chosen an existing profile, select **Properties** and then select **Settings**.
161
161
162
-
2. In the **Endpoint protection** pane, select **Windows Defender Exploit Guard**, then select **Attack Surface Reduction**. Select the desired setting for each attack surface reduction rule.
162
+
2. In the **Endpoint protection** pane, select **Windows Defender Exploit Guard**, and then select **Attack Surface Reduction**. Select the desired setting for each attack surface reduction rule.
163
163
164
164
3. Under **Attack Surface Reduction exceptions**, enter individual files and folders. You can also select **Import** to import a CSV file that contains files and folders to exclude from attack surface reduction rules. Each line in the CSV file should be formatted as follows:
165
165
@@ -177,8 +177,8 @@ You can use Microsoft Intune OMA-URI to configure custom attack surface reductio
177
177
178
178
2. In **Create a profile**, in the following two drop-down lists, select the following:
179
179
180
-
- In **Platform**, select **Windows 10 and later**
181
-
- In **Profile type**, select **Templates**
180
+
- In **Platform**, select **Windows 10 and later**.
181
+
- In **Profile type**, select **Templates**.
182
182
- If attack surface reduction rules are already set through Endpoint security, in **Profile type**, select **Settings Catalog**.
183
183
184
184
3. Select **Custom**, and then select **Create**.
@@ -235,7 +235,7 @@ You can use Microsoft Intune OMA-URI to configure custom attack surface reductio
235
235
236
236
3. In **Value**, enter the applicable value or value range.
237
237
238
-
:::image type="content" source="media/mem07-5-applicability-rules.png" alt-text="The applicability rules in the Microsoft Intune admin center portal" lightbox="media/mem07-5-applicability-rules.png":::
238
+
:::image type="content" source="media/mem07-5-applicability-rules.png" alt-text="The applicability rules in the Microsoft Intune admin center portal." lightbox="media/mem07-5-applicability-rules.png":::
239
239
240
240
11. Select **Next**. In step **6 Review + create**, review the settings and information you've selected and entered, and then select **Create**.
241
241
@@ -245,7 +245,7 @@ You can use Microsoft Intune OMA-URI to configure custom attack surface reductio
245
245
246
246
> [!NOTE]
247
247
> Regarding conflict handling, if you assign a device two different attack surface reduction policies, potential policy conflicts can occur, depending on whether rules are assigned different states, whether conflict management is in place, and whether the result is an error.
248
-
> Nonconflicting rules do not result in an error, and such rules are applied correctly. The first rule is applied, and subsequent nonconflicting rules are merged into the policy.
248
+
> Nonconflicting rules don't result in an error, and such rules are applied correctly. The first rule is applied, and subsequent nonconflicting rules are merged into the policy.
249
249
250
250
### MDM
251
251
@@ -290,7 +290,7 @@ Example:
290
290
6. After the policy is created, select **Close**.
291
291
292
292
> [!WARNING]
293
-
> There is a known issue with the applicability of attack surface reduction on Server OS versions which is marked as compliant without any actual enforcement. Currently, there is no defined release date for when this will be fixed.
293
+
> There's a known issue with the applicability of attack surface reduction on Server OS versions which is marked as compliant without any actual enforcement. Currently, there's no defined release date for when this will be fixed.
294
294
295
295
> [!IMPORTANT]
296
296
> If you're using "Disable admin merge" set to `true` on devices, and you're using any of the following tools/methods, adding ASR rules per-rule exclusions or local ASR rule exclusions don't apply.
@@ -316,15 +316,15 @@ Example:
316
316
- 0: Disable (Disable the attack surface reduction rule)
317
317
- 1: Block (Enable the attack surface reduction rule)
318
318
- 2: Audit (Evaluate how the attack surface reduction rule would impact your organization if enabled)
319
-
- 6: Warn (Enable the attack surface reduction rule but allow the end-user to bypass the block)
319
+
- 6: Warn (Enable the attack surface reduction rule but allow the end-user to bypass the block)
320
320
321
321
:::image type="content" source="media/asr-rules-gp.png" alt-text="attack surface reduction rules in Group Policy" lightbox="media/asr-rules-gp.png":::
322
322
323
323
5. To exclude files and folders from attack surface reduction rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Select **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item.
324
324
325
325
> [!WARNING]
326
-
> Do not use quotes as they are not supported for either the **Value name** column or the **Value** column.
327
-
> The rule ID should not have any leading or trailing spaces.
326
+
> Don't use quotes as they aren't supported for either the **Value name** column or the **Value** column.
327
+
> The rule ID shouldn't have any leading or trailing spaces.
328
328
329
329
### PowerShell
330
330
@@ -333,7 +333,7 @@ Example:
333
333
334
334
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**.
335
335
336
-
2. Type one of the following cmdlets. (For more information, such as rule ID, refer to [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md).)
336
+
2. Type one of the following cmdlets. For more information, such as rule ID, refer to [Attack surface reduction rules reference](attack-surface-reduction-rules-reference.md).
0 commit comments