ADMX Viewer
AddDefenderPolicies.Policies.AddDefenderPolicies• Machine

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Download ADMX

This rule blocks executable files, such as .exe, .dll, or .scr, from launching. Thus, launching untrusted or unknown executable files can be risky, as it might not be initially clear if the files are malicious. You must enable cloud-delivered protection to use this rule.

Policy Details

Policy Name
ExploitGuard_ASR_Rules_SmartScreen
Registry Key
Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
Supported On
At least Windows Server 2016, Windows 10 Version 1803
Available Languages
en-usfr-fr

Configuration Elements

ASR rule modes: Not configured or Disable: The state in which the ASR rule isn't enabled. Block: The state in which the ASR rule is enabled. Audit: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). Warn: The state in which the ASR rule is enabled and presents a notification to the end-user, but permits the end-user to bypass the block.

Mode:

Type: enum

Allowed Values
  • 0 Disabled
  • 2 Audit
  • 6 Warn
  • 1 Block