Fix: “Windows cannot access the specified device, path, or file” When Clicking Links in New Outlook

A customer switched to the new version of Outlook for Windows and quickly discovered that clicking any link in an email would trigger an error instead of opening it in the browser. The error said Windows could not access the file and that they might not have the right permissions. Links worked fine when they switched back to Classic Outlook, so the issue was specific to New Outlook. After investigating, we traced it to Microsoft Defender’s Attack Surface Reduction rules blocking the New Outlook app from launching URLs. Here is how to fix it.

Symptoms

When clicking a hyperlink in an email using New Outlook for Windows, the following error appears:

Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

• The error occurs with any link in any email, not just specific URLs.
• Links work correctly when opened in Classic Outlook on the same computer.
• Manually copying the URL and pasting it into the browser works fine.
• A Windows Security notification may briefly appear saying the action was blocked, but checking Protection History in Windows Security shows no corresponding entry.

Affected Software

• Application: New Outlook for Windows (the modern Outlook app, not Classic Outlook)
• Platform: Windows 10 / Windows 11
• Related Services: Microsoft Defender for Endpoint, Attack Surface Reduction (ASR) rules, Microsoft Intune

Cause

This issue is caused by Microsoft Defender Attack Surface Reduction (ASR) rules blocking the New Outlook executable (HxOutlook.exe) from launching URLs in the default browser.

New Outlook runs as a Windows Store app from the C:\Program Files\WindowsApps directory. ASR rules designed to prevent Office applications from creating child processes or launching executable content can inadvertently block New Outlook from opening links, because the ASR rule does not recognise HxOutlook.exe as a trusted Office process in the same way it recognises OUTLOOK.EXE (Classic Outlook).

This commonly affects organisations that deploy ASR rules via Microsoft Intune or Group Policy, particularly the rule: “Block all Office applications from creating child processes” (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a).

Resolution

Method 1: Add an ASR Exclusion for New Outlook (Recommended)

Add the New Outlook executable to the ASR exclusion list. This can be done via PowerShell, Intune, or Group Policy.

Via PowerShell (single machine)

1. Open PowerShell as Administrator.
2. Run the following command:
   Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\WindowsApps\microsoft.outlookforwindows_*\HxOutlook.exe"
3. Restart the computer.
4. Open New Outlook and test clicking a link.

Via Microsoft Intune (managed environment)

1. Open the Microsoft Intune admin centre.
2. Go to Endpoint security > Attack surface reduction > ASR rules.
3. Edit the relevant ASR policy.
4. Under Attack Surface Reduction Only Exclusions, add:
   C:\Program Files\WindowsApps\microsoft.outlookforwindows_*\HxOutlook.exe
5. Save and sync policies to affected devices.

Method 2: Set the Specific ASR Rule to Audit Mode

If you are unsure which ASR rule is causing the block, you can set the “Block Office applications from creating child processes” rule to Audit mode instead of Block:

1. Open PowerShell as Administrator.
2. Run:
   Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions AuditMode
3. Test links in New Outlook.
4. Check Windows Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational for ASR audit events (Event ID 1122) to confirm which rule was triggering.

Method 3: Use Classic Outlook (Workaround)

If the ASR exclusion cannot be applied immediately, users can switch back to Classic Outlook as a workaround:

1. In New Outlook, click the toggle in the top right corner that says “Try the new Outlook” to switch it off.
2. Alternatively, open Classic Outlook directly from the Start menu.
3. Links will work normally in Classic Outlook while the ASR configuration is being updated.

Verify the Fix

1. Open New Outlook and click a link in any email.
2. Confirm the link opens in the default browser without an error.
3. Test with multiple links from different emails to confirm the fix is consistent.

Important Notes

• ASR exclusions are security-sensitive. Adding an exclusion reduces the protection provided by the ASR rule. However, excluding New Outlook specifically is generally safe, as it is a signed Microsoft application.
• The wildcard in the path is intentional. New Outlook updates frequently, and the version number in the WindowsApps path changes with each update. The wildcard (*) ensures the exclusion applies to all versions.
• This issue does not affect Classic Outlook. Classic Outlook (OUTLOOK.EXE) is already recognised by ASR rules as a trusted Office process.
• Check for Intune policy conflicts. If the exclusion is added locally via PowerShell but an Intune ASR policy is also deployed, the Intune policy may overwrite the local setting. Apply the exclusion at the Intune level for managed devices.
• Controlled Folder Access can also cause similar symptoms. If the ASR exclusion does not resolve the issue, check whether Controlled Folder Access is blocking New Outlook under Windows Security > Virus & threat protection > Ransomware protection.

Related Resources

• Microsoft: Attack surface reduction rules reference
• Microsoft: Enable attack surface reduction rules
• Microsoft: Test attack surface reduction rules

If you need help resolving Outlook or Windows Defender policy issues, get in touch with our team.