How to Configure Attack Surface Reduction Rules in Audit Mode
Applies to: Windows Server 2019, 2022 and 2025, subject to installed updates and feature availability.
ASR rules can block risky application behaviours. Audit mode measures compatibility before enforcement and should be reviewed through Defender telemetry.
Security controls should be piloted, monitored and reversible through console access. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Confirm Defender Antivirus is active.
- Inventory applications and scripts.
- Choose relevant ASR rules from Microsoft documentation.
- Enable central event collection.
Procedure
Step 1: Capture current settings
Export Defender preferences.
Get-MpPreference | Select AttackSurfaceReductionRules_Ids,AttackSurfaceReductionRules_ActionsStep 2: Use Group Policy or management platform
Configure selected ASR rule IDs in Audit mode rather than applying an unreviewed blanket set.
Step 3: Update Defender
Use current engine and signatures.
Update-MpSignatureStep 4: Exercise workloads
Run representative scheduled tasks, installers and business applications.
Step 5: Review events
Inspect ASR audit events in Defender Operational log.
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 500 | Where Id -In 1121,1122Step 6: Move selected rules to Block
Enforce only after owner approval and exception review.
Verification
Confirm configured rule IDs and analyze audit events by application and server role.
Get-MpPreference | Select -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select -ExpandProperty AttackSurfaceReductionRules_ActionsRollback and recovery
Return affected rules to Audit or Disabled through the same central policy and remove only narrowly approved exclusions.
Security notes
ASR availability and behaviour depend on platform, Defender version and installed applications; validate each server role.
Official references
Explore Netcloud24 Canada.
