Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Vulnerabilities and exposure

Defender Endpoint Demonstration Attack Surface Reduction Rules

4 September 2026Doc updateAction required+21 / −13 lines

In brief

The documentation now warns that the setup script excludes `c:\demo` from Microsoft Defender Antivirus scanning. Administrators must copy ASR test files to a folder not excluded by Defender Antivirus or ASR rules before opening or running them, then delete the copies afterward.

What Defender admins need to know

Update demonstration procedures so ASR blocks and detections are evaluated correctly; running samples from `c:\demo` may prevent expected results.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • demo ms.topic: how-to ms.subservice: asr ms.custom: msecd-doc-authoring-10161015 ms.date: 07/02/08/12/2026 ai-usage: ai-assisted appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Enables the demonstration ASR rules in Enabled (block) mode.
    • Adds c:\demo to the CFA protected folders list (without affecting your other protected folders).

  1. Create the folder c:\demo.

  2. Add c:\demo to the Microsoft Defender Antivirus exclusion list so that real-time protection doesn't quarantine the test files before the ASR rules evaluatewhile you download and extract them. Run the following command in an elevated PowerShell window:

    Add-MpPreference -ExclusionPath C:\demo

Scenario 1: All demonstration ASR rules block the test files

PerformDo the following steps to confirm that all demonstration ASR rules block their corresponding test files:

  1. Enable the demonstration ASR rules in Block mode. Run the WindowsDefender_ASR_Block.ps1 script (see Set up the demonstration), or use the PowerShell command.
  2. Download andBefore you open or run a test file, make sure the file is in a folder that isn't excluded from Microsoft Defender Antivirus or ASR rules. If you use a test file that the setup script extracted to c:\demo\ASRSamplesAll, copy it to a folder that isn't excluded. Don't run the test files.file from c:\demo or one of its subfolders. If prompted, enable editing and content.

You should immediately see an "Action blocked" notification.

Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled


1. OpenFind the test file for the rule you want to test, as listed in the [ASR rules in this demonstration](#asr-rules-in-this-demonstration) table. Files marked _in `ASRSamplesAll.zip`_ are already extracted to `c:\demo\ASRSamplesAll`.
1. Copy the test file to a folder that isn't excluded from Microsoft Defender Antivirus or ASR rules. Don't open or run the test file from `c:\demo` or one of its subfolders. For example, for the **Block all Office applications from creating child processes** rule, open `c:\demo\ASRSamplesAll\TestFile_OfficeChildProcess_D4F940AB-copy `TestFile_OfficeChildProcess_D4F940AB-401B-4EFC-AADC-AD5F3C50688A.docm`. from `c:\demo\ASRSamplesAll` to a folder that isn't excluded.
1. Open or run the copied test file. If prompted, enable editing and content.

You should immediately see an "Action blocked" notification.


### Scenario 3: An ASR rule blocks an unsigned file that runs from a USB drive

PerformDo the following steps to verify that the USB execution rule blocks an unsigned file.

1. Enable the **Block untrusted and unsigned processes that run from USB** ASR rule by running the following command in an elevated PowerShell window:


### Scenario 4: Without ASR rules, the ransomware test file encrypts files

PerformTurn off the following stepsdemonstration ASR rules to observe how the ransomware test file behaves when ASR rules are disabled.

1. Turn offDo either of the demonstrationfollowing steps to disable the ASR rules.rules:
- Run the `WindowsDefender_ASR_Disabled.ps1` script (see [Set up the demonstration](#set-up-the-demonstration)), or use.
- Use the `Add-MpPreference` PowerShell command to disable the rules (see [Clean up the demonstration](#clean-up-the-demonstration)).
1. Run the ransomware test file (`ransomware_testfile_exe.exe`) from `c:\demo\ASRSamplesAll`.

- TheAs a result, the files in `c:\demo` are encrypted and you get a warning message.
-

Run the test file again to decrypt the files.

## Clean up the demonstration


Whichever method you used, the cleanup script doesn't delete the test files or remove the `c:\demo` Microsoft Defender Antivirus exclusion that the setup script (or the manual steps) added. To fully revert the changes:

1. Delete any test files that you copied outside `c:\demo`.

1. Delete the `c:\demo` folder and the test files it contains. Do this step _before_ you remove the exclusion in the next step. Otherwise, when real-time protection resumes for the folder, Microsoft Defender Antivirus detects the leftover test files (for example, as `Trojan:Win32/Vigorf.A`) and quarantines them. Run the following command in an elevated PowerShell window:

```powershell