Fix: “Action Blocked” When Opening Email Attachments in Outlook (Attack Surface Reduction)

A construction firm contacted us because their team could no longer open file attachments received via email. Every time they tried to open an attached file from Outlook, a Windows Security notification appeared saying the action had been blocked by their administrator. The issue affected multiple users and was preventing them from accessing project files sent by clients and contractors. Here is what caused it and how to fix it.

Symptoms

When attempting to open a file attachment from Outlook (or save it to a local folder and open it from there), the following Windows Security notification appears:

Action blocked
Your administrator caused Windows Security to block this action. Contact your help desk.

You may also experience:

• The file appears to download or save successfully, but Windows blocks it when you try to open it
• The same file type opens normally when downloaded from a website or copied from a USB drive
• The issue affects specific file types (e.g. .ifc, .exe, .msi) but not common Office documents
• Multiple users on the same network are affected
• No entry appears in Windows Security Protection History, making it difficult to identify what was blocked

Variant: “Risky action blocked” when opening IFC models in Trimble Connect

On current Windows 11 builds the same problem can show as Risky action blocked instead. Construction and steel fabrication teams see it when they open an IFC model straight from an email and Outlook tries to launch Trimble Connect. Windows Security Protection history shows:

Risky action blocked
App or process blocked: OUTLOOK.EXE
Blocked by: Attack surface reduction
Rule: Block only Office communication applications from creating child processes
Affected items: C:\Program Files\Trimble\Trimble Connect\TrimbleConnect.exe

This is a different ASR rule from the one above. Saving the IFC file to the desktop first and opening it from there works, because Outlook is no longer the app launching Trimble Connect.

Affected Software

• Application: Microsoft Outlook (classic and new), Windows Security
• Platform: Windows 10 / Windows 11
• Related Services: Microsoft Defender for Endpoint, Microsoft Intune, Group Policy

Cause

This error is caused by Attack Surface Reduction (ASR) rules in Microsoft Defender. ASR rules are security policies designed to block potentially dangerous behaviours, such as executable content from email clients or Office applications launching child processes.

The specific ASR rule causing this issue is typically:

• “Block executable content from email client and webmail” (GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550)

This rule blocks applications launched from email attachments that match certain criteria. While this is a legitimate security measure, it can be overly aggressive and block safe file types that your business relies on, such as industry-specific formats (.ifc for construction, .dwg for engineering) or legitimate application installers.

ASR rules are typically deployed through:

• Microsoft Intune endpoint security policies
• Group Policy in on-premises environments
• Microsoft Defender for Endpoint security baselines

Resolution

Method 1: Add a Path Exclusion via PowerShell (Quick Fix)

If you know the folder path where the blocked application or file type is installed, you can exclude it from ASR rules.

1. Open PowerShell as Administrator
2. Run the following command, replacing the path with the relevant application or folder:

   Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\YourApplication"

3. To add multiple paths, run the command once for each path
4. Test by opening the previously blocked file to confirm the issue is resolved

Example: For construction software like Trimble, the command would be:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\Trimble"

Method 2: Configure ASR Exclusions via Intune

For managed environments where policies are deployed centrally through Microsoft Intune:

1. Sign in to the Microsoft Intune admin centre (intune.microsoft.com)
2. Navigate to Endpoint security > Attack surface reduction
3. Select the relevant ASR policy
4. Under Attack Surface Reduction Only Exclusions, add the file path or application path that needs to be excluded
5. Save the policy and wait for devices to sync (or force a sync via Company Portal)

Method 3: Configure ASR Exclusions via Group Policy

For on-premises environments managed by Group Policy:

1. Open Group Policy Management Editor
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
3. Open Exclude files and paths from Attack Surface Reduction rules
4. Set to Enabled and add the required file paths
5. Run gpupdate /force on affected machines

Method 4: Set the ASR Rule to Audit Mode

If you are unsure which rule is causing the block, you can temporarily set ASR rules to audit mode to identify the issue without blocking anything:

1. Open PowerShell as Administrator
2. Run the following to set the “Block executable content from email” rule to audit mode:

   Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions AuditMode

3. Check Event Viewer under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational for ASR audit events (Event ID 1121 for blocks, 1122 for audits)
4. Once you have identified the blocked path, add it as an exclusion using Method 1, 2, or 3
5. Set the rule back to block mode after adding the exclusion

Trimble Connect and IFC models: making the fix stick

We have fixed the Trimble Connect version of this for a steel fabrication business several times, so these are the points that matter:

1. Exclude the right rule. Add C:\Program Files\Trimble\Trimble Connect\TrimbleConnect.exe (or the C:\Program Files\Trimble folder) as a per-rule exclusion on Block only Office communication applications from creating child processes, not as a global exclusion.
2. Put it in Intune, not just PowerShell. An exclusion added on the PC with Add-MpPreference can be wiped by a Windows feature update. That is why this problem came back roughly every six months until the exclusion lived in the central Intune ASR policy.
3. Check every ASR policy. If two ASR policies are assigned to the same devices, both need the exclusion. We found an older second policy without the Trimble entry, which conflicted and kept blocking on some PCs.
4. Make sure the PC can receive policy. A PC that isn’t Entra joined or registered never gets the Intune exclusion. Having the user sign in to Outlook or Company Portal with their work account fixed one of the stragglers.
5. Restart Trimble Connect, or the PC, once the policy has arrived, and test by opening an IFC attachment from Outlook.

This section is based on fixes by Rohan Colley, Senior Systems Administrator, Ellen Sawa-an, IT Support Specialist, and Elliot Munro, CISO at GCIT.

Important Notes

• Security trade-off: ASR exclusions reduce your security posture. Only exclude paths that you trust and that are required for business operations. Avoid excluding broad paths like C:\ or C:\Users
• Be specific with paths: Exclude the narrowest path possible. For example, exclude C:\Program Files\Trimble\Tekla rather than C:\Program Files
• Protection History may be empty: ASR blocks do not always appear in the Windows Security Protection History UI. Use Event Viewer or audit mode to identify what is being blocked
• Multiple users affected: If the issue affects multiple machines, configure the exclusion centrally via Intune or Group Policy rather than running PowerShell on each device individually
• After adding exclusions, verify the fix by opening the previously blocked file type from an email attachment

Related Resources

• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Enable attack surface reduction rules
• GCIT: Fix “Windows cannot access the specified device” when clicking links in New Outlook
• Fix: “550 5.0.350” Attachment File Type Not Allowed
• Fix: Word “File Not Found. Check the File Name and Try Again” on Save
• Fix: HubSpot Outlook Add-in Keeps Disappearing (“Not Logged In”)
• IT support for engineering and construction firms at GCIT

If you need help resolving Windows Security or Attack Surface Reduction issues, get in touch with our team.