Exclude files and paths from Attack Surface Reduction Rules
- Policy ID
- ExploitGuard_ASR_ASROnlyExclusions
- Scope
- Computer Configuration
- Supported on
- At least Windows Server 2016, Windows 10 Version 1709
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › Microsoft Defender Antivirus › Microsoft Defender Exploit Guard › Attack Surface Reduction
Description
Exclude files and paths from Attack Surface Reduction (ASR) rules.
Enabled:
Specify the folders or files and resources that should be excluded from ASR rules in the Options section.
Enter each rule on a new line as a name-value pair:
- Name column: Enter a folder path or a fully qualified resource name. For example, ""C:\Windows"" will exclude all files in that directory. ""C:\Windows\App.exe"" will exclude only that specific file in that specific folder
- Value column: Enter ""0"" for each item
Disabled:
No exclusions will be applied to the ASR rules.
Not configured:
Same as Disabled.
You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting.
Options
Registry
ComputerHKEY_LOCAL_MACHINE
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR View registry values
- ExploitGuard_ASR_ASROnlyExclusions-
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyExclusions View registry values
- (list values)REG_SZ