ASR - Excel Memory Issue

Part 1: ASR / Excel Memory Issue

Identify the blocking ASR rule — Use Advanced Hunting in the Microsoft Defender portal to find the exact ASR rule causing the block. Run the following KQL query:

DeviceEvents
| where ActionType startswith "Asr"
| where InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "powerpnt.exe")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName
| order by Timestamp desc
| take 50

Verify exclusion paths are local — ASR exclusions must target local file paths (e.g., C:\Users\\AppData\Local\Temp\), not network/UNC paths. ASR runs as NT AUTHORITY\SYSTEM and cannot resolve network shares. Check that your excluded paths match the local temp paths shown in the ASR block events.

Use ASROnlyExclusions — Instead of general antivirus exclusions, configure ASR-specific exclusions via Intune: Go to Intune > Endpoint Security > Attack Surface Reduction > Create policy and add the specific file or folder paths under exclusions.

Review which ASR rules are active — Ensure only the rules relevant to your environment are in Block mode. Common Office-related ASR rules to review:

• Block Win32 API calls from Office macros
  • Block Office applications from creating executable content
    • Block Office applications from injecting code into other processes
    Set problematic rules to Audit mode — If a specific rule is causing issues, set it to Audit mode temporarily while you configure proper exclusions, then re-enable Block mode.

Removing users from Application Control policy — Removing all users from an Application Control (WDAC) policy deployed via Intune will not trigger an immediate sign-out or restart prompt. However:

• The policy removal will take effect after the next Intune sync cycle (typically within 8 hours, or force sync via Company Portal)
• A restart may be needed for WDAC policy changes to fully take effect on the device
• While in Audit mode, removing users should have no visible impact since it's only logging, not blocking

Reference

• ASR rules reference - Microsoft Defender for Endpoint
• Exclusions for ASR rules (Intune)
• Enable ASR rules - troubleshooting
• Application control for Windows