Registry Key for Windows Defender ASR Rules

Attack Surface Reduction (ASR) rules in Windows Defender Exploit Guard help prevent common malware infection vectors. This article identifies the exact Windows Registry paths used to configure and enforce ASR rules, explains how specific rule IDs (GUIDs) map to registry values, and breaks down the numerical state codes required to manage blocking, auditing, and warning modes.

The Primary ASR Registry Keys

The behavior of Attack Surface Reduction rules is primarily controlled through two registry locations depending on whether the configuration is enforced via policy or stored locally.

Policy-Enforced Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules

Local/Applied Key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules

How ASR Rules Are Structured in Regedit

Within the ...\ASR\Rules key, individual rules are configured as distinct registry values:

• Value Name: The specific ASR Rule GUID (e.g., d4f940ab-401b-4efc-aadc-ad5f3c50688a for blocking credential stealing from the Windows local security authority subsystem).
• Value Type: REG_SZ (String) or REG_DWORD
• Value Data: A numerical value that determines the enforcement state of the rule.

ASR Rule State Values

When configuring values under the Rules key, use the following integers to set the behavior for each rule GUID:

Related ASR Registry Keys

To manage exclusions alongside ASR rules, Windows Defender utilizes a dedicated exclusions subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Exclusions

• Value Name: The full path to the excluded executable or folder.
• Value Type: REG_SZ or REG_DWORD
• Value Data: 0 (enables the exclusion).