Configure ASR Rules in Windows 11 Pro and Enterprise

Attack Surface Reduction (ASR) rules in Windows 11 help prevent common malware infection vectors by restricting risky behaviors, such as launching executable files from Office apps or running obfuscated scripts. This guide details how to configure ASR rules on Windows 11 Pro and Enterprise editions using Group Policy, PowerShell, and Microsoft Intune, as well as how to verify their operation.

Understanding ASR Rule States

Before configuring rules, choose the appropriate enforcement state for your environment:

• Disabled (0): The rule is turned off.
• Block (1): Actions violating the rule are blocked immediately.
• Audit (2): Actions are allowed, but an event is logged in Windows Event Viewer to evaluate impact.
• Warn (6): Users see a prompt allowing them to bypass the block if necessary.

Method 1: Configure ASR Rules via Group Policy (Pro and Enterprise)

Group Policy allows local or domain-level management of ASR rules.

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
3. Double-click the policy named Configure Attack Surface Reduction rules.
4. Select Enabled.
5. Under the Options section, click the Show… button.
6. In the Value Name column, enter the specific ASR Rule GUID (for example, d4f940ab-401b-4efc-aadc-ad5f3c50688a to block Office applications from creating child processes).
7. In the Value column, set the state:
   • 1 for Block
   • 2 for Audit
   • 6 for Warn
8. Click OK, then click Apply and OK.

Method 2: Configure ASR Rules via PowerShell (Pro and Enterprise)

PowerShell provides a quick method to configure individual or multiple ASR rules locally.

1. Right-click the Start menu and select Terminal (Admin) or PowerShell (Admin).
2. Run the Set-MpPreference cmdlet using the rule GUID and desired action.

To enable a rule in Block mode:

Set-MpPreference -AttackSurfaceReductionRules_Ids <Rule-GUID> -AttackSurfaceReductionRules_Actions Enabled

To enable a rule in Audit mode:

Set-MpPreference -AttackSurfaceReductionRules_Ids <Rule-GUID> -AttackSurfaceReductionRules_Actions AuditMode

To disable a rule:

Set-MpPreference -AttackSurfaceReductionRules_Ids <Rule-GUID> -AttackSurfaceReductionRules_Actions Disabled

Example (Block executable content from email client and webmail):

Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled

Method 3: Configure ASR Rules via Microsoft Intune (Enterprise)

For enterprise environments using cloud endpoint management, Microsoft Intune offers centralized deployment.

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Endpoint security > Attack surface reduction.
3. Select Create Policy.
4. Set Platform to Windows 10, Windows 11, and Windows Server and Profile to Attack Surface Reduction rules. Click Create.
5. Enter a name and description for the policy, then click Next.
6. In the Configuration settings tab, locate the individual ASR rules and set them to Block, Audit mode, or Warn.
7. Assign the policy to target device or user groups, review the configuration, and click Save.

Verifying ASR Configuration and Events

Check Active Rules via PowerShell

Run the following command in an elevated PowerShell prompt to list active rule IDs and their configured states:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

View ASR Events in Event Viewer

When an ASR rule triggers, Microsoft Defender logs the event to the system:

1. Open Event Viewer (eventvwr.msc).
2. Navigate to: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
3. Look for the following Event IDs:
   • Event ID 1121: Rule triggered in Block mode.
   • Event ID 1122: Rule triggered in Audit mode.
   • Event ID 1123: Rule triggered in Warn mode.