Apply a list of exclusions to specific attack surface reduction (ASR) rules
- Policy ID
- ExploitGuard_ASR_ASROnlyPerRuleExclusions
- Scope
- Computer Configuration
- Supported on
- At least Windows Server 2016, Windows 10 Version 1709
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › Microsoft Defender Antivirus › Microsoft Defender Exploit Guard › Attack Surface Reduction
Description
This policy allows an administrator to specify a list of exclusions for specific ASR rules.
Each entry is a name-value pair. The key indicates the rule GUID, and the value is a set of full paths separated by the > character, indicating the exclusions for that particular ASR rule.
NOTE: The GUID is a KEY, not a value.
Example:
KEY: "{75668C1F-73B5-4CF0-BB93-3ECF5DB7C484}"
VALUE: "C:\Notepad.exe>c:\regedit.exe>C:\SomeFolder\test.exe"
Options
Registry
ComputerHKEY_LOCAL_MACHINE
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR View registry values
- ExploitGuard_ASR_ASROnlyPerRuleExclusions-
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\ASROnlyPerRuleExclusions View registry values
- (list values)REG_SZ