>

Enable Defender ASR Rules with PowerShell

Switch on individual attack surface reduction rules — e.g. block Office apps from creating child processes.

WindowsdefendersecurityasrLow risk
Run `Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled` to enforce that ASR rule.

01Command

Command
$ Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

02What it does

Each ASR rule has a fixed GUID — D4F940AB… blocks Office applications from spawning child processes, a common ransomware entry point. You enable rules one at a time or in bulk, and the Actions value also supports AuditMode to log blocks without enforcing them. Review events in the Microsoft Defender event log before flipping rules from audit to enabled.

03Risk

RiskLow risk
RequirementsAdministrator PowerShell; requires Microsoft Defender Antivirus as the active antivirus (third-party AV replaces it).
!Warning: Enabling all rules at once on a home PC can block scripts and installers you actually need; audit first.

04Undo

Undo
$ Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Disabled

05Sources

  • Enable attack surface reduction rules
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: PowerShell instructions use Add-MpPreference with -AttackSurfaceReductionRules_Ids and -AttackSurfaceReductionRules_Actions, listing rule GUIDs including D4F940AB-401B-4EFC-AADC-AD5F3C50688A.
  • Add-MpPreference (Defender)
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents the AttackSurfaceReductionRules_Ids and AttackSurfaceReductionRules_Actions parameters.

Last verified: 2026-09-19 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Take ownership of a file or folder with takeown and icacls
WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17
Verify File Hashes with certutil -hashfile
Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17