ADMX Viewer
AddDefenderPolicies.Policies.AddDefenderPolicies• Machine

Block Office applications from injecting code into other processes

Download ADMX

This rule blocks code injection attempts from Office apps into other processes. This rule applies to Word, Excel, OneNote, and PowerPoint.

Policy Details

Policy Name
ExploitGuard_ASR_Rules_Office_Injection
Registry Key
Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
Supported On
At least Windows Server 2016, Windows 10 Version 1709
Available Languages
en-usfr-fr

Configuration Elements

ASR rule modes: Not configured or Disable: The state in which the ASR rule isn't enabled. Block: The state in which the ASR rule is enabled. Audit: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). Note: The Block applications from injecting code into other processes ASR rule doesn't support WARN mode.

Mode:

Type: enum

Allowed Values
  • 0 Disabled
  • 2 Audit
  • 1 Block