Fix: Business Application Blocked by Attack Surface Reduction (ASR) Rules

An engineering firm contacted us because one of their staff could not open a specialised structural analysis program. Every time they tried to launch the application, Windows blocked it silently or displayed a brief notification that the action had been blocked. The same issue started affecting multiple users across different workstations and spread to other applications from the same vendor. Here is what caused it and how to fix it.

Symptoms

When attempting to launch a desktop application, Windows blocks the program from running. You may see one of the following:

Operation did not complete successfully because the file contains a virus or potentially unwanted software.

This app has been blocked for your protection. An administrator has blocked you from running this app.

You may also see a Windows Security notification in the system tray mentioning Attack Surface Reduction blocked an action. In some cases, the application simply fails to launch with no visible error at all.

Common scenarios where this occurs:

• Specialised industry software (engineering, accounting, legal, medical) that is not widely distributed
• Applications installed to non-standard directories like C:\Users\*\AppData\Local\
• Software that launches child processes or helper executables
• Programs that were working previously but started being blocked after a Windows or Defender update
• The issue affects multiple users across different machines with the same security policy

Affected Software

• Security Feature: Microsoft Defender Attack Surface Reduction (ASR) rules
• Platform: Windows 10 / Windows 11
• Management: Microsoft Intune, Group Policy, or PowerShell
• Affected Applications: Any business application that does not meet Microsoft’s prevalence, age, or trusted list criteria

Cause

Attack Surface Reduction (ASR) is a set of rules in Microsoft Defender that block behaviours commonly used by malware. One rule in particular causes most of these issues:

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

This rule prevents executables from running unless Microsoft’s cloud protection service recognises them as safe based on how widely they are used, how long they have existed, or whether they appear on a trusted list. Specialised business software (engineering tools, accounting packages, medical practice software) is often flagged because it has low global prevalence compared to mainstream applications like Microsoft Office or Chrome.

The issue can appear intermittently. An application may work for weeks and then suddenly be blocked after a Defender signature update changes the prevalence data or after the application is updated to a new version.

Resolution

Method 1: Add an ASR Exclusion via Microsoft Intune (Recommended for Managed Environments)

If your devices are managed through Microsoft Intune, add the application path to the ASR exclusions in your endpoint security policy.

1. Sign in to the Microsoft Intune admin center
2. Navigate to Endpoint security > Attack surface reduction
3. Open your existing ASR policy (or create a new one)
4. Under Attack Surface Reduction Only Exclusions, click + Add
5. Enter the folder path of the blocked application. Use a broad path to cover all executables from that vendor:
   C:\Program Files (x86)\[Vendor Name]\
   Or for applications in the user’s AppData folder, use a wildcard:
   C:\Users\*\AppData\Local\[Vendor Name]\
6. Click Save and wait for the policy to sync to affected devices
7. To force an immediate sync, open Settings > Accounts > Access work or school on the affected PC, click on the connected account, and select Info > Sync

You can also add per-rule exclusions if you want the exclusion to apply only to the specific ASR rule causing the block (e.g. “Block executable files from running unless they meet a prevalence, age, or trusted list criterion”) rather than all ASR rules.

Method 2: Add an ASR Exclusion via PowerShell (Quick Fix)

If you need an immediate fix on a single machine, or your environment is not managed through Intune, use PowerShell:

1. Open PowerShell as Administrator
2. Run the following command, replacing the path with the folder containing the blocked application:

   Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files (x86)\[Vendor Name]\"

3. To verify the exclusion was added:

   Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionOnlyExclusions

4. Try launching the application again. It should open without being blocked

Method 3: Add an ASR Exclusion via Group Policy

For environments managed through Group Policy:

1. Open the Group Policy Management Console
2. Edit the relevant GPO and navigate to:
   Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
3. Open Exclude files and paths from Attack surface reduction Rules
4. Set it to Enabled
5. Click Show and add the application path (e.g. C:\Program Files (x86)\[Vendor Name]\)
6. Click OK and run gpupdate /force on affected machines

How to Identify Which ASR Rule Is Blocking the Application

If you are unsure whether ASR is the cause, check the Windows Event Log:

1. Open Event Viewer
2. Navigate to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
3. Look for Event ID 1121 (ASR rule blocked) or Event ID 1122 (ASR rule audited)
4. The event details will show the rule name, the blocked file path, and the process that triggered the block

Important Notes

• Do not disable ASR entirely. ASR rules provide important protection against malware. Always add specific path exclusions rather than turning off the feature
• Use the narrowest exclusion possible. Exclude the specific application folder rather than broad paths like C:\ or C:\Users\
• If the blocked application installs to AppData\Local, use a wildcard for the username: C:\Users\*\AppData\Local\[Vendor]\
• Exclusions set via PowerShell are local only and will not persist if an Intune or Group Policy overwrites local settings. For a permanent fix in managed environments, always configure exclusions in Intune or Group Policy
• If the application is updated to a new version, the exclusion should still apply as long as the installation path remains the same
• Consider setting the ASR rule to Audit mode temporarily if you need to identify all affected applications before adding exclusions

Related Resources

• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Enable attack surface reduction rules
• GCIT: Fix “Action Blocked” When Opening Email Attachments in Outlook (ASR)

If you need help resolving application blocking or security policy issues, get in touch with our team.