You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
2.[Use audit mode to test the rule](#use-audit-mode-to-test-the-rule).
44
+
3.[Add exclusions for the specified rule](#add-exclusions-for-a-false-positive) (for false positives).
45
+
4.[Collect and submit support logs](#collect-microsoft-defender-anti-malware-protection-diagnostic-data-for-file-submissions).
46
46
47
47
## Confirm prerequisites
48
48
@@ -69,7 +69,7 @@ One of the easiest ways to determine if attack surface reduction rules are alrea
69
69
70
70
Here's an example:
71
71
72
-
:::image type="content" source="media/getmpreferencescriptnew.png" alt-text="Screenshot showing the get mppreference script" lightbox="media/getmpreferencescriptnew.png":::
72
+
:::image type="content" source="media/getmpreferencescriptnew.png" alt-text="Screenshot showing the get mppreference script." lightbox="media/getmpreferencescriptnew.png":::
73
73
74
74
There are multiple attack surface reduction rules active, with different configured actions.
:::image type="content" source="media/getmpref-examplenew.png" alt-text="Screenshot showing the get mpreference example" lightbox="media/getmpref-examplenew.png":::
84
+
:::image type="content" source="media/getmpref-examplenew.png" alt-text="Screenshot showing the get mpreference example." lightbox="media/getmpref-examplenew.png":::
85
85
86
86
The preceding image shows all the IDs for attack surface reduction rules that have a setting different from 0 (Not Configured).
87
87
@@ -91,7 +91,7 @@ The next step is then to list the actual actions (Block or Audit) that each rule
:::image type="content" source="media/getmpref-example2new.png" alt-text="Screenshot that shows the get mppreference example2" lightbox="media/getmpref-example2new.png":::
94
+
:::image type="content" source="media/getmpref-example2new.png" alt-text="Screenshot that shows the get mppreference example2." lightbox="media/getmpref-example2new.png":::
95
95
96
96
## Use audit mode to test the rule
97
97
@@ -116,7 +116,7 @@ Attack surface reduction rule events can be viewed within the Windows Defender l
116
116
117
117
To access it, open Windows Event Viewer, and browse to **Applications and Services Logs**\>**Microsoft**\>**Windows**\>**Windows Defender**\>**Operational**.
118
118
119
-
:::image type="content" source="media/eventviewerscrnew.png" alt-text="Image that shows the Event Viewer page" lightbox="media/eventviewerscrnew.png":::
119
+
:::image type="content" source="media/eventviewerscrnew.png" alt-text="Screenshot that shows the Event Viewer page." lightbox="media/eventviewerscrnew.png":::
120
120
121
121
## Add exclusions for a false positive
122
122
@@ -157,7 +157,7 @@ You can find this utility in *%ProgramFiles%\Windows Defender\MpCmdRun.exe*. You
157
157
158
158
To generate the support information, type `MpCmdRun.exe -getfiles`. After a while, several logs will be packaged into an archive (MpSupportFiles.cab) and made available at `C:\ProgramData\Microsoft\Windows Defender\Support`.
159
159
160
-
:::image type="content" source="media/malware-prot-logsnew.png" alt-text="Screenshot that shows the malware protection logs" lightbox="media/malware-prot-logsnew.png":::
160
+
:::image type="content" source="media/malware-prot-logsnew.png" alt-text="Screenshot that shows the malware protection logs." lightbox="media/malware-prot-logsnew.png":::
161
161
162
162
Extract that archive and you have many files available for troubleshooting purposes.
0 commit comments