Would you like to learn how to configure attack surface reduction rules using Powershell? In this tutorial, we will show you how to use the command line to add an ASR rule on Windows Defender.
• Windows 2012 R2
• Windows 2016
• Windows 2019
• Windows 2022
• Windows 10
• Windows 11
Equipment list
Here you can find the list of equipment used to create this tutorial.
This link will also show the software list used to create this tutorial.
Related tutorial - PowerShell
On this page, we offer quick access to a list of tutorials related to PowerShell.
Tutorial Powershell ASR - Configure attack surface reduction rules
Start an elevated Powershell command line.
Add an ASR rule using Powershell.
In our example, we add a rule to block JavaScript or VBScript from launching downloaded executable content.
There are multiple actions available.
List all configured ASR rules.
Here is the command output.
Restart the computer to enable the ASR rules.
Optionally, restart the Defender real-time protection to enable the ASR rules.
Create a test file.
Here is the file content.
Test the ASR rule to Block JavaScript or VBScript from launching downloaded executable content.
Here is the command output.
List events related to ASR rules.
Here is the command output.
Disable an ASR rule using Powershell.
Remove an ASR rule using Powershell.
Congratulations! You are able to configure ASR rules using Powershell.
