Skip to content

Commit f59d779

Browse files
authored
Fixed missing periods
1 parent 7077b7d commit f59d779

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

defender-endpoint/troubleshoot-asr.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ When you use [attack surface reduction rules](attack-surface-reduction.md) you m
3939

4040
There are four steps to troubleshooting these problems:
4141

42-
1. [Confirm prerequisites](#confirm-prerequisites)
43-
2. [Use audit mode to test the rule](#use-audit-mode-to-test-the-rule)
44-
3. [Add exclusions for the specified rule](#add-exclusions-for-a-false-positive) (for false positives)
45-
4. [Collect and submit support logs](#collect-microsoft-defender-anti-malware-protection-diagnostic-data-for-file-submissions)
42+
1. [Confirm prerequisites](#confirm-prerequisites).
43+
2. [Use audit mode to test the rule](#use-audit-mode-to-test-the-rule).
44+
3. [Add exclusions for the specified rule](#add-exclusions-for-a-false-positive) (for false positives).
45+
4. [Collect and submit support logs](#collect-microsoft-defender-anti-malware-protection-diagnostic-data-for-file-submissions).
4646

4747
## Confirm prerequisites
4848

@@ -69,7 +69,7 @@ One of the easiest ways to determine if attack surface reduction rules are alrea
6969

7070
Here's an example:
7171

72-
:::image type="content" source="media/getmpreferencescriptnew.png" alt-text="Screenshot showing the get mppreference script" lightbox="media/getmpreferencescriptnew.png":::
72+
:::image type="content" source="media/getmpreferencescriptnew.png" alt-text="Screenshot showing the get mppreference script." lightbox="media/getmpreferencescriptnew.png":::
7373

7474
There are multiple attack surface reduction rules active, with different configured actions.
7575

@@ -81,7 +81,7 @@ Example:
8181
Get-MPPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
8282
```
8383

84-
:::image type="content" source="media/getmpref-examplenew.png" alt-text="Screenshot showing the get mpreference example" lightbox="media/getmpref-examplenew.png":::
84+
:::image type="content" source="media/getmpref-examplenew.png" alt-text="Screenshot showing the get mpreference example." lightbox="media/getmpref-examplenew.png":::
8585

8686
The preceding image shows all the IDs for attack surface reduction rules that have a setting different from 0 (Not Configured).
8787

@@ -91,7 +91,7 @@ The next step is then to list the actual actions (Block or Audit) that each rule
9191
Get-MPPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions
9292
```
9393

94-
:::image type="content" source="media/getmpref-example2new.png" alt-text="Screenshot that shows the get mppreference example2" lightbox="media/getmpref-example2new.png":::
94+
:::image type="content" source="media/getmpref-example2new.png" alt-text="Screenshot that shows the get mppreference example2." lightbox="media/getmpref-example2new.png":::
9595

9696
## Use audit mode to test the rule
9797

@@ -116,7 +116,7 @@ Attack surface reduction rule events can be viewed within the Windows Defender l
116116

117117
To access it, open Windows Event Viewer, and browse to **Applications and Services Logs** \> **Microsoft** \> **Windows** \> **Windows Defender** \> **Operational**.
118118

119-
:::image type="content" source="media/eventviewerscrnew.png" alt-text="Image that shows the Event Viewer page" lightbox="media/eventviewerscrnew.png":::
119+
:::image type="content" source="media/eventviewerscrnew.png" alt-text="Screenshot that shows the Event Viewer page." lightbox="media/eventviewerscrnew.png":::
120120

121121
## Add exclusions for a false positive
122122

@@ -157,7 +157,7 @@ You can find this utility in *%ProgramFiles%\Windows Defender\MpCmdRun.exe*. You
157157

158158
To generate the support information, type `MpCmdRun.exe -getfiles`. After a while, several logs will be packaged into an archive (MpSupportFiles.cab) and made available at `C:\ProgramData\Microsoft\Windows Defender\Support`.
159159

160-
:::image type="content" source="media/malware-prot-logsnew.png" alt-text="Screenshot that shows the malware protection logs" lightbox="media/malware-prot-logsnew.png":::
160+
:::image type="content" source="media/malware-prot-logsnew.png" alt-text="Screenshot that shows the malware protection logs." lightbox="media/malware-prot-logsnew.png":::
161161

162162
Extract that archive and you have many files available for troubleshooting purposes.
163163

0 commit comments

Comments
 (0)