Blocked by MS Defender

[JoergM-D]

Hello, since my complete reinstallation of my PC (Win 11 22H2 and Office 2019) Defender s blocking the Plugin.

Execption doesn't work...any idear, getting it running again?

[HoffmannTom]

Hello, that's not the win10/win11 defender. This is defender for endpoint, an enterprise solution. I assume, that your computer is provisioned by your company which uses ASR rules in defender for endpoint (?) In this case, only an IT guy can configure a whitelist in the ASR rule. Greetings, Thomas

[JoergM-D]

Hello Tom,

thanks for your quick response. I’m using Windows 11 (22H2)and I finnished the installation 4 days ago. Outlook is from Office 2019 Home and Business.

Before I started reinstalling everything, it was running…

Greetings Jörg

Von: HoffmannTom @.> Gesendet: Donnerstag, 3. November 2022 19:13 An: HoffmannTom/outlookbackupaddin @.> Cc: JoergM-D @.>; Author @.> Betreff: Re: [HoffmannTom/outlookbackupaddin] Blocked by MS Defender (Issue #80)

Hello, that's not the win10 defender. This is defender for endpoint, an enterprise solution. I assume, that your computer is provisioned by your company which uses ASR rules in defender for endpoint (?) In this case, only an IT guy can configure a whitelist in the ASR rule. Greetings, Thomas

— Reply to this email directly, view it on GitHub https://github.com/HoffmannTom/outlookbackupaddin/issues/80#issuecomment-1302496255 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AUK5DIQNKMTEKOMC5SMRY7TWGP6EPANCNFSM6AAAAAARWMNWVI . You are receiving this because you authored the thread. https://github.com/notifications/beacon/AUK5DIUYJJKHM7AWMILLEETWGP6EPA5CNFSM6AAAAAARWMNWVKWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSNUKB76.gif Message ID: @.*** @.***> >

[HoffmannTom]

The question is, if you have installed "Defender for endpoint" or if your Computer is connected to a company network? ASR and how to configure it, is explained here (german version): https://learn.microsoft.com/de-de/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide

[JoergM-D]

Nothing at all, it's a private Desktop-PC, Defender is the basic from Windows 11.I can't create/edit any policies-- Diese Nachricht wurde von meinem Android Mobiltelefon mit 1&1 Mail gesendet.Am 04.11.22, 12:38 schrieb HoffmannTom @.***>:

The question is, if you have installed "Defender for endpoint" or if your Computer is connected to a company network? ASR and how to configure it, is explained here (german version): https://learn.microsoft.com/de-de/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: @.***>

[HoffmannTom]

You can read about more on this page: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-all-office-applications-from-creating-child-processes It seems like Office is activating an ASR rule called "Block all Office applications from creating child processes" If you dont have policies (home edition), you can use PowerShell to configure ASR rules: https://4sysops.com/archives/configure-attack-surface-reduction-in-microsoft-defender-using-group-policy-or-powershell/

[JoergM-D]

H Tom,

I reinstalled my PC once again, now it’s running.

Cheers

Jörg

Von: HoffmannTom @.> Gesendet: Freitag, 4. November 2022 12:39 An: HoffmannTom/outlookbackupaddin @.> Cc: JoergM-D @.>; Author @.> Betreff: Re: [HoffmannTom/outlookbackupaddin] Blocked by MS Defender (Issue #80)

The question is, if you have installed "Defender for endpoint" or if your Computer is connected to a company network? ASR and how to configure it, is explained here (german version): https://learn.microsoft.com/de-de/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide

— Reply to this email directly, view it on GitHub https://github.com/HoffmannTom/outlookbackupaddin/issues/80#issuecomment-1303302217 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AUK5DIQXXR4CC7IAH7CKF5TWGTYTNANCNFSM6AAAAAARWMNWVI . You are receiving this because you authored the thread. https://github.com/notifications/beacon/AUK5DIRY57FPDB4FUSLMMDTWGTYTNA5CNFSM6AAAAAARWMNWVKWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSNV3IES.gif Message ID: @.*** @.***> >