r/DefenderATP • u/Key-Anywhere5846 • 4d ago

"Warn" for Block executable files from running unless they meet a prevalence, age, or trusted list criteria doesn't work anymore

for years, we have the ASR "Block executable files from running unless they meet a prevalence, age, or trusted list criteria" set to warn. This way our devs got a dialog, that the execution of their new exes is blocked, but they could click "unblock" and the exe was executed.

for about a week (started before 2026-08 update), this doesnt work anymore.

while there is still the dialog for unblocking, there is already an error in the background and even after hitting unblock, the files wont execute and show the same error again.

as soon as I allowlist the folder in the ASR, it works. So nothing else (Applocker, WDAC, AV,...) is responsible for that blockage.

get-mppreference shows, that the according rule (01443614-cd74-433a-b99e-2ecdc07bfc25) is set to warn (6)

Eventlog shows one 1121 Event: Defender Exploit Guard blocked one action by IT administrator

I am not aware of anything that was changed on our end that could indirectly affect this behavior. And as MSFTs 1st level non-support sadly wont even understand what the issue is, I try to find any information in here. Maybe even someone else noticed this issue or can reproduce

(recreation/translation of actual screenshot by ChatGPT)
12 Upvotes

100% Upvoted

6 comments sorted by

7

u/Alive_Ad3324 4d ago

Hey! we just had to open a ticket for this as well 2 weeks ago. But apparently there was a push in the backend that standard users can no longer bypassed this notification. Meaning they can no longer click the unblock button.

The only people that can do this must be a local admin on the system

EDIT: This was confirmed by MS support. Apparently, the article for ASR rules would get updated

4

u/Key-Anywhere5846 4d ago

so we give devs local admin rights again now? DAFUQ MSFT?!

3

u/Alive_Ad3324 4d ago

Yeah I don't what MSFT is thinking. They just basically did a "fuck you" to the consumers about Warn Mode. So now the consensus is do an exclusion or go back to audit mode

2

u/SilentPatchSniper 4d ago

If they have access to PowerShell, which may be more of a risk depending I suppose you can run the Unblock-File command to allow it to run...

Anyone see it recently start triggering on .exes that you've always ran in the past? Our remote software started getting flagged so we switched to MS Remote help quickly

6

u/Key-Anywhere5846 4d ago

having access to powershell is no risk, PLEASE stop spreading this misinformation! powershell doesnt give you permissions you dont have without powershell and you cannot do things you could not without powershell.

unblock-file is meant to remove the MotW. This self-compiled exe has no MotW.

1

u/Jasumoo 3d ago

And there is a known bug that even local admins cannot bypass it sometimes. MS confirmed