Configure Attack Surface Reduction rules
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1709
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction Description
Set the state for each Attack Surface Reduction (ASR) rule. After enabling this setting, you can set each rule to the following in the Options section: - Block: the rule will be applied - Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) - Off: the rule will not be applied - Not Configured: the rule is enabled with default values - Warn: the rule will be applied and the end-user will have the option to bypass the block Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. Enter each rule on a new line as a name-value pair: - Name column: Enter a valid ASR rule ID - Value column: Enter the status ID that relates to state you want to specify for the associated rule The following status IDs are permitted under the value column: - 1 (Block) - 0 (Off) - 2 (Audit) - 5 (Not Configured) - 6 (Warn) Example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 Disabled: No ASR rules will be configured. Not configured: Same as Disabled. You can exclude folders or files in the ""Exclude files and paths from Attack Surface Reduction Rules"" GP setting.
Registry
Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR Value name: ExploitGuard_ASR_Rules
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules Multiple CSP matches are possible; the first one was selected.
Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure Attack Surface Reduction rules
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1709
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR]
"ExploitGuard_ASR_Rules"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExploitGuard_ASR_Rules' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules
Data type: String
Value:
<enabled/>
<!-- ExploitGuard_ASR_Rules: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR' -Name 'ExploitGuard_ASR_Rules' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExploitGuard_ASR_Rules' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR' -Name 'ExploitGuard_ASR_Rules' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure Attack Surface Reduction rules
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExploitGuard_ASR_Rules' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.