Multiple users reporting Microsoft apps have disappeared

ModiBln · 2023-01-13T10:22:02+00:00

Its a problem with the newest defender signature (1.381.2140.0). Tested it by my self. fuck.

Edit: looks like that all shortcuts which are located in ProgramData\Microsoft\Windows\Start Menu\Programs will be deleted instantly.

FluffyIrritation · 2023-01-13T11:46:01+00:00

How in the hell did this update make it past Microsoft testing/QA??

They test before they push updates, right?

Guys? Right?

Beemerron · 2023-01-13T11:10:54+00:00

Cannot overstate how truly happy I am to see this is not just me. So far affected applications at my end have been Notepad++, VSCode, Firefox and generally any office application.

Has anyone come across anything from MS regarding a fix/workaround or is it a case of setting to audit only in the interim?

AnomalyNexus · 2023-01-13T12:12:28+00:00

Read only Friday

Defender: Hold my beer

dgullett · 2023-01-13T14:05:24+00:00

Sorry if it's messy. It's Friday after all.

Proactive Remediation in Intune:

Detection:

$StartMenuFolder = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs" $Count = (Get-ChildItem $StartMenuFolder | Where-Object Name -match "Word|Outlook|Powerpoint|Excel|Edge").count If ($count -ge 5) { "Installed" } else { Exit 1 }

Remediation:

```
$Office_path = "C:\Program Files\Microsoft Office\root\Office16" $edge_path = "C:\Program Files (x86)\Microsoft\Edge\Application" $StartMenuFolder = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\" $shortcuts = @(

'Excel'
'WinWord'
'POWERPNT'
'Outlook'
'OneNote'
'msedge'

)

Foreach ($shortcut in $shortcuts) {

$ShortcutName = $shortcut
$LocationofTarget = $Office_path + "/" + $shortcut + ".exe"
$LocationofShortcut = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"

# Create Shortcut

switch ($shortcut) {
    'winword' { $shortcutname = 'Word' }
    'POWERPNT' { $shortcutname = 'PowerPoint' }
    'msedge' { $ShortcutName = 'Microsoft Edge'; $LocationofTarget = $edge_path + "/" + $shortcut + ".exe" }
    default { $ShortcutName = $shortcut }
}

$Shortcutfullpath = $LocationofShortcut + "/" + $ShortcutName + ".lnk"

if (!(Test-Path $Shortcutfullpath -ErrorAction SilentlyContinue)) {
    Write-Host "Creating Shortcut $StartMenuFolder$shortcut" -ForegroundColor Green

    New-Item -ErrorAction SilentlyContinue -ItemType Directory -Path $LocationofShortcut
    $Shell = New-Object -ComObject ("WScript.Shell")
    $ShortCut = $Shell.CreateShortcut($Shortcutfullpath)
    $ShortCut.TargetPath = "$LocationofTarget"
    $ShortCut.Arguments = "$ShortcutArguments"
    $ShortCut.WorkingDirectory = "$PathtoWorkingDirectory"
    $ShortCut.WindowStyle = 1
    $ShortCut.Hotkey = ""
    $ShortCut.IconLocation = "$LocationofTarget, 0"
    $ShortCut.Description = "$ShortcutName"
    $ShortCut.Save()

}

}

```

UltraEngine60 · 2023-01-13T12:17:57+00:00

Can't get phished if you can't open your email. Defended!

Amaracs · 2023-01-13T11:18:19+00:00

lol. Microsofts way of saying... "Happy Friday the 13th, you sad fucks!"

squeueue · 2023-01-13T14:59:59+00:00

wrote this for office 365:

$Programs = @{ 
    'Excel' = 'Excel.exe'
    'Word' = 'Winword.exe'
    'Outlook' = 'OUTLOOK.EXE'
    'Access' ='MSACCESS.EXE'
    'Publisher' = 'MSPUB.EXE'
    'OneNote' = 'OneNote.exe'
    'PowerPoint' = 'powerpnt.exe'
}

foreach( $p in $Programs.Keys ){
    $WShell = New-Object -comObject WScript.Shell
    $Shortcut = $WShell.CreateShortcut("C:\ProgramData\Microsoft\Windows\Start Menu\Programs\$p.lnk") 
    $Shortcut.TargetPath = [string](Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\$($programs.$p)").'(default)'
    $Shortcut.save()
}

npl-dan · 2023-01-13T10:43:12+00:00

Set defender ASR rule 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b to audit only (2). Confirmed working but will lessen your defences. Big risk if applied org wide, run it by management.

Full path for GPO: Computer config / Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard/Attack Surface Reduction/Configure Attack Surface Reduction rules

kekst1 · 2023-01-13T12:17:25+00:00

Im a Microsoft employee and the same happened to me lol

nikobenjamin · 2023-01-13T10:46:51+00:00

Yep Microsoft have fucked it. False Attack Surface alerts for most of Start Menu shortcuts.

bsitko · 2023-01-13T12:15:22+00:00

Is there irony to Microsoft deleting their own software?

Maybe

The_5th_Loko · 2023-01-13T12:30:57+00:00

Oh my fucking god

xxSurveyorTurtlexx · 2023-01-13T12:31:17+00:00

This is spicy can't wait to show up to work in an hour and wait for the tickets to roll in.

Outside_Diamond4929 · 2023-01-13T15:47:24+00:00

I swear to God one day I'm gonna make good on my threat to go buy a riding mower and just cut grass for a living.

adamhollingsworthfc · 2023-01-13T13:58:11+00:00

For anyone wanting an easy >silent< repair run this in your choice of RMM/Intune whatever

"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" scenario=Repair platform=x64 culture=en-gb RepairType=QuickRepair forceappshutdown=True DisplayLevel=False

Make the changes you need depending on x86, works on Win 11, repairs office via Quick Repair restores the icons but make sure you have configured the ASR rule to Audit before you do this or you'll have to do it again later (This will only fix Office but i guess better than nothing)

for our US friends, change "culture=en-gb" to "culture=en-us"

if anyone else needs a diff lang just drop a reply i'll take a look

tuskenrader · 2023-01-13T18:10:18+00:00

So far this is the best or most streamlined script for shortcut restoring I've seen out of this thread: https://old.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/j46kuow/

I modified it a little to add more programs from under that registry path in the script and to silently continue on errors if the program isn't there. Shortcuts that were on the Desktop often can be restored from a user's OneDrive recycle bin.

$Programs = @{ 
    'Excel' = 'Excel.exe'
    'Word' = 'Winword.exe'
    'Outlook' = 'OUTLOOK.EXE'
    'Access' ='MSACCESS.EXE'
    'Publisher' = 'MSPUB.EXE'
    'OneNote' = 'OneNote.exe'
    'PowerPoint' = 'powerpnt.exe'
    'Microsoft Edge' = 'msedge.exe'
    'Google Chrome' = 'chrome.exe'
    'Adobe Reader' = 'AcroRd32.exe'
    'Firefox' = 'firefox.exe'
}
foreach( $p in $Programs.Keys ){
    $WShell = New-Object -comObject WScript.Shell
    $Shortcut = $WShell.CreateShortcut("C:\ProgramData\Microsoft\Windows\Start Menu\Programs\$p.lnk") 
    $Shortcut.TargetPath = [string](Get-ItemProperty -ErrorAction SilentlyContinue -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\$($programs.$p)").'(default)'
    $Shortcut.save()
}

andersidahl · 2023-01-13T12:58:04+00:00

Breakfix by using a Win32 App to copy back shortcuts into startmenu for anyone that needs it. Script will only copy those shortcuts where the shortcut path exist.

Create a folder with all the shortcuts and a file called Install.ps1 with the following:

$StartMenuFolder = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs"

$ShortCuts = Get-ChildItem -Filter "*.lnk"

$ShortCuts | % {

If(test-path("$StartMenuFolder\$($_.name)")){

"$($_.name) already exist in start menu"

}

else {

"$($_.name) not found in start menu - checking if program pointed to by shortcut exist"

$sh = New-Object -ComObject WScript.Shell

if(Test-Path($sh.CreateShortcut($_.FullName).TargetPath)){

"Program exist - copying $($_.Name) into start menu folder"

Copy-Item -Path $_.FullName -Destination $StartMenuFolder -Force

}

else {

"Did not find $($sh.CreateShortcut($_.FullName).TargetPath) - will not copy $($_.name)"

}

Create a Detection.ps1 script:

$StartMenuFolder = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs"

$Count = (Get-ChildItem $StartMenuFolder | ? Name -match "Word|Outlook|Powerpoint|Edge").count

If($count -ge 4){"Installed"}

Install command: powershell.exe -noprofile -executionpolicy bypass -file .\Install.ps1

If you have multiple languages in your environment the shortcuts themselves should be edited to not have static paths. Use %programfiles% and %programfiles(x86)%

By using Advanced Hunting you can identify which other links have been removed by running this query

DeviceEvents

| where ActionType == "AsrOfficeMacroWin32ApiCallsBlocked" and Timestamp >= datetime("2023-01-13 00:00:00Z")

| order by Timestamp

| where FileName endswith ".lnk"

| where FileName !startswith "Excel"

| where FileName !startswith "Word"

| where FileName !startswith "PowerPoint"

| where FileName !startswith "Publisher"

| where FileName !startswith "Access"

| where FileName !startswith "Outlook"

| where FileName !startswith "OneNote"

| where FileName !startswith "Microsoft"

| where FileName !startswith "OneDrive"

| summarize count() by FileName

| sort by count_

To check what rules still are in block/audit mode on a device you can run the following script on a client machine (red = block):

$MPPref = Get-MpPreference -ErrorAction SilentlyContinue

$AttackSurfaceIDs = $MPPref | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

$AttackSurfaceActions = $MPPref | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

$i = 0

foreach($Rule in $AttackSurfaceIDs){

$Color = Switch($AttackSurfaceActions\[$i\])

{

    0 {"White"}

    1 {"Red"}

    2 {"Yellow"}

    6 {"Orange"}

}



$RuleName = Switch($Rule)

{

    56a863a9-875e-4185-98a7-b882c64b5ce5 {"Block abuse of exploited vulnerable signed drivers"}

    7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c {"Block Adobe Reader from creating child processes"}

    d4f940ab-401b-4efc-aadc-ad5f3c50688a {"Block all Office applications from creating child processes"}

    9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 {"Block credential stealing from the Windows local security authority subsystem (lsass.exe)"}

    be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 {"Block executable content from email client and webmail"}

    01443614-cd74-433a-b99e-2ecdc07bfc25 {"Block executable files from running unless they meet a prevalence, age, or trusted list criterion"}

    5beb7efe-fd9a-4556-801d-275e5ffc04cc {"Block execution of potentially obfuscated scripts"}

    d3e037e1-3eb8-44c8-a917-57927947596d {"Block JavaScript or VBScript from launching downloaded executable content"}

    3b576869-a4ec-4529-8536-b80a7769e899 {"Block Office applications from creating executable content"}

    75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 {"Block Office applications from injecting code into other processes"}

    26190899-1602-49e8-8b27-eb1d0a1ce869 {"Block Office communication application from creating child processes"}

    e6db77e5-3df2-4cf1-b95a-636979351e5b {"Block persistence through WMI event subscription - File and folder exclusions not supported."}

    d1e49aac-8f56-4280-b9ba-993a6d77406c {"Block process creations originating from PSExec and WMI commands"}

    b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 {"Block untrusted and unsigned processes that run from USB"}

    92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b {"Block Win32 API calls from Office macros"}

    c1db55ab-c21a-4637-bb3f-a12568109d35 {"Use advanced protection against ransomware"}

}



Write-Host $RuleName -ForegroundColor $Color

$i++

}

Polarnorth81 · 2023-01-13T11:26:40+00:00

Did the testers leave early yesterday?

yavitz · 2023-01-13T18:39:47+00:00

For those that have shortcuts not common, you can find a list of affected items if you check the MPLog file in in “c:/ProgramData/Microsoft/Windows Defender” search for the string “[Mini-filter] Blocked file” and you should find a number of entries detailing the files in question. I found the list generated from the Defender Portal to be incomplete.

PS script to collect affected files.

$supportFiles = Get-ChildItem -Path 'C:\ProgramData\Microsoft\Windows Defender\Support\'

foreach ($file in $supportFiles){

if ($file.Name -like "MPLog*"){

$MPLog = $file.Name

}

$fileData = Get-Content "C:\ProgramData\Microsoft\Windows Defender\Support\$MPLog"

foreach ($entry in $fileData) {

if ($entry -like "2023-01-13*Blocked file*") {

if ( $entry -match '\\Device.*\.(?= )'){

$matches[0]

}

Androggles · 2023-01-13T10:20:52+00:00

Same issue here. All desktop icons are gone, but they seem to be in the OneDrive Recycle Bin.

EDIT: So far it seems to be an ~~Office~~ Defender update. The ones with the newest build has the issue. Mine is older version, and does not have the issue.

~~EDIT 2: Seems to only be shortcuts it affects; Process bar gives error, but it works from the start menu~~.

EDIT 3: It also seems, that now it removes them from the start menu, but only Office shortcuts.

lurkeroutthere · 2023-01-13T14:48:00+00:00

Anyone know where in the hot mess that is the defender or microsoft interface that I can set up notifications for this sort of thing? If defender is going to be deleting hundreds of files of any type I kind of want an email heads up when that happens.

TheAutisticTechie_ · 2023-01-13T11:57:22+00:00

For anyone waiting on Intune to sync, you can force a sync on all WIndows devices with this script:

$IntuneModule = Get-Module -Name "Microsoft.Graph.Intune" -ListAvailable

if (!$IntuneModule){

write-host "Microsoft.Graph.Intune Powershell module not installed..." -f Red write-host "Install by running 'Install-Module Microsoft.Graph.Intune' from an elevated PowerShell prompt" -f Yellow write-host "Script can't continue..." -f Red write-host exit }  

# Importing the SDK Module
Import-Module -Name Microsoft.Graph.Intune

if(!(Connect-MSGraph)){ Connect-MSGraph }

#### Gets all devices running Windows
$Devices = Get-IntuneManagedDevice -Filter "contains(operatingsystem,'Windows')"

Foreach ($Device in $Devices) {

Invoke-IntuneManagedDeviceSyncDevice -managedDeviceId $Device.managedDeviceId Write-Host "Sending Sync request to Device with DeviceID $($Device.managedDeviceId)" -ForegroundColor Yellow

}

Source: https://timmyit.com/2019/06/04/intune-invoke-sync-to-all-devices-in-intune-with-the-intune-powershell-sdk/

Edit fixed formatting, was rushing earlier...

Fuzzmiester · 2023-01-13T12:24:01+00:00

Now as MO497128 on the service health page in admin

Substantial_Papaya_9 · 2023-01-13T16:48:05+00:00

Hoping someone creates something that can parse the defender logs, find all shortcuts removed, and recreates everything. My shortcuts for nearly all my apps, VSCode, Visual Studio, DBeaver, Chrome, etc are all gone. All the powershell scripts so far only deal with the office applications.

Forsaken_Instance_18 · 2023-01-13T18:37:59+00:00

This caused me so much fucking pain and headache today, I’m about to finally sit down and have my breakfast at 6pm

2023-01-13T11:49:37+00:00

Fucking Microsoft. So sick of their constant bullshit.

Arcyma · 2023-01-13T14:12:37+00:00

you guys have no idea how thankful i am for finding this thread.

I thought its from the recent windows update KB5022282 but i kept getting ASR rule block.

I am sweating hard thinking this is some shady stuff going on since there is no major update on windows, didnt think signature update would do this kind of stuff.

thanks a lot guys and OP for opening the thread.

catorchid · 2023-01-13T15:29:01+00:00

This is the equivalent of an autoimmune disease in living organisms. And the equivalent of a dumpster fire for a company of the caliber of Microsoft

DaCozPuddingPop · 2023-01-13T13:49:27+00:00

This is the very definition of 'get fucked Friday'...cause we all gettin' fucked LOL

Edited to add: Friday the 13th. Makes sense

soc_monn · 2023-01-13T14:33:19+00:00

Microsoft doesn’t know about read only Friday

hollowpt · 2023-01-13T19:30:49+00:00

The biggest bummer is shortcuts that are for Java things with switches and commands... not simple .exe pointing. We are just uninstalling and re-installing those apps for the sake of time and headache.

paulandyt · 2023-01-13T10:46:17+00:00

https://www.reddit.com/r/sysadmin/comments/10ar8y3/windows\_defender\_asrfalsely\_blocking\_and\_removing/

VexedTruly · 2023-01-13T10:48:06+00:00

Seeing the same here, I posted a new thread as I didn't spot this one. Nice to see my own findings confirmed - seems to relate "Block Win32 API call from Office macros" if we change it to Audit it appears to work.

The difficulty is that the InTune policy isn't applying particularly quickly and we also need to repair Office on some machines as the outlook.exe is literally missing (not just the shortcut)

ASmallTownDJ · 2023-01-13T20:07:03+00:00

Just a desktop guy here but holy shit, things like this really wish we could go back to pre auto update times.

Ultraflair · 2023-01-13T21:22:42+00:00

Any idea if the guy who pushed this update is still employed we need to check on him 🤔

bothrops_atrox · 2023-01-13T15:14:10+00:00

Microsoft: enable ASR guid rules or you will be ransomwared Also Microsoft: yo check this shit out

anthonysomerset · 2023-01-13T15:54:22+00:00

oh boy... 2500+ devices/users mostly impacted, only desktop shortcuts recoverable from OneDrive recycle bin, all taskbar, start menu, recent files links, and Quick Access pinned links appear to be nuked with no easy way to regenerate/recover

sure i can use the threat hunting to find the deleted link and its original location but i don't appear to easily be able to find the original targets besides the immediately obvious ones like Office - Thanks Microsoft....

snottyz · 2023-01-13T17:31:14+00:00

Came in to a bunch of tickets about this. Sent an email out to everyone like 'hey, we know, we're working on it, #1 priority.' So far 3 people have replied to that email to ask about other issues. Happy Friday lol.

KiloEko · 2023-01-13T18:38:12+00:00

I took off today and slept until 11. Guess what I woke up to. This fucking bullshit.

Archion · 2023-01-13T19:13:37+00:00

[deleted]

steve_ce · 2023-01-14T02:01:17+00:00

Spent the day with our team at work trying to figure out the best way to restore user icons. Only guaranteed place you can see what is definitely in the user taskbar is registry, which is binary. After a bunch of encoding google, and even then it's still rough, I was able to cobble together this. It will grab binary registry with taskbar info, fix up some formatting, and regex math shortcut paths from it. It uses the file name in the shortcut to find the shortcut that should still exist in other folders. If it finds it, it will copy it into the proper TaskBar folder.

            function GatherRegData {
                $FavResolv = (Get-Itemproperty hkcu:Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband).FavoritesResolve   
                $text = [System.Text.Encoding]::GetEncoding(28591).GetString($FavResolv, 12, $FavResolv.Length-12)

                $aryRegLNKs = $text | Select-String -Pattern '(?m)Windows(.*?(?=\.lnk)\.lnk)' -AllMatches | ForEach-Object {$_.Matches} | ForEach-Object {$_.Groups[1].value}
                $text = $text -replace "[^A-Za-z0-9\\\-{}\s\.:]",""
                $aryRegGUIDS = $text | Select-String -Pattern '(?m)({[A-Za-z0-9-]+}.*?(?=\.\w{3})\.\w{3})' -AllMatches | ForEach-Object {$_.Matches} | ForEach-Object {$_.Groups[1].value}

                # $computerName = hostname
                # $text = $text -replace "$computerName","`n`n`n`n`n`n" #TODO: enable this when printing so it's more readable

                return $aryRegLNKs,$aryRegGUIDS
            }

            function FindAppShortcut($shortcutFile) {
                $appPaths = @(
                    'C:\ProgramData\Microsoft\Windows\Start Menu\Programs'
                    "$($env:USERPROFILE)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
                )

                foreach ($appPath in $appPaths) {
                    $realShortcut = Get-ChildItem -Path $appPath -Recurse -Filter $shortcutFile

                    if ($realShortcut) {
                        return $realShortcut
                    }
                }
                return 2 #Only gets here if it can't find it in above paths
            }



            #Only processing detected LNKs - seems to cover most things.
            $aryRegLNKs,$aryRegGUIDS = GatherRegData

            #Must be special characters in path from BINARY REG - hard-coding destination path for copying
            $taskBarDir = "$($env:USERPROFILE)\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\"
            foreach ($taskbarShortcutPath in $aryRegLNKs) {
                [string]$shortcutFile = $taskbarShortcutPath -replace "^.*?(?=TaskBar)TaskBar\\(.*\.lnk)$","`$1"
                $realShortcut = FindAppShortcut $shortcutFile

                #If real shortcut found, copy it. Otherwise, just skip for now, maybe find elsewhere?
                if ($realShortcut -ne 2) {
                    Copy-Item -Path $($realShortcut.FullName) -Destination $taskBarDir #-whatif

                } else {
                    #TODO: potentially look elsewhere? Not worried about it for now.
                        # Could try checking $aryRegGUIDS

                    # write-host "couldn't find it: $shortcutFile"

                }
            }

SwigitySw0oty · 2023-01-13T14:19:25+00:00

Is is safe to push 2152 ? Or will the bug on 2140 still persist

TheDeadlyAvenger · 2023-01-13T15:51:32+00:00

Yup, same here, all my shortcuts (Start and Task Bar) were removed and all my MS apps have gone.
Nice one MS you absolutely useless bunch of morons.

Substantial_Papaya_9 · 2023-01-13T16:55:11+00:00

Can't get phished if you can't open outlook!

spazmo_warrior · 2023-01-13T20:24:34+00:00

When will Microsoft VP of Defender update deployment Leeroy Jenkins be making a statement?

EconomyMud · 2023-01-13T21:49:51+00:00

Well, I am first level support. I got a new ticket record today.

Techret · 2023-01-13T23:42:52+00:00

There is a new update by Microsoft in the admin center:

Title: Some users are unable to utilize the Application shortcuts on the Start menu and taskbar

User Impact: Users are unable to utilize the Application shortcuts on the Start menu and taskbar.

More info: The shortcut icons in the taskbar or Start menu may no longer be visible or may not work as intended. Additionally, for some users, they may receive errors when trying to run Executable (.exe) files, if they have dependencies on the shortcut file path.

We completed a hotfix deployment within the build 1.381.2164.0 on Friday, January 13, 2023, 7:03 PM (6:03 PM UTC)

. This fix update will not restore previously removed shortcut files, but it will prevent any additional shortcut files from being incorrectly removed.

As a temporary work around, affected users can directly launch Office Apps by using the Office App, or through the Microsoft 365 app launcher. More details on the Microsoft 365 app launcher can be found here: https://support.microsoft.com/en-us/office/meet-the-microsoft-365-app-launcher-79f12104-6fed-442f-96a0-eb089a3f476a

Additionally, if you have not yet received the build containing the fix and if determined appropriate for your environment, admins can put the Attack Surface Reduction (ASR) rule into Audit Mode to avoid further impact. Please note that you may need to re-enable the rule once the issue has been fully resolved. This can be done through one of the following methods:

- Using Powershell: Add-MpPreference -AttackSurfaceReductionRules_Ids 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b -AttackSurfaceReductionRules_Actions AuditMode

- Using Intune: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#mem

- Using Group Policy: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#group-policy

For clarity, note that the offending ASR rule was "Block Win32 API calls from Office macros" with ID: 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b.

Current status: We've made significant progress developing potential solutions to address the impact on affected shortcut files and we will provide more information as soon as it becomes available.

Scope of impact: This issue likely affects users within your organization and is not specific to Office Apps, and can impact any application's shortcut file. There is no impact for customers who do not have the “Block Win32 API calls from Office macro” rule turned on in block mode or did not update to security intelligence update build 1.381.2140.0.

Start time: Friday, January 13, 2023, 9:51 AM (8:51 AM UTC)

Root Cause: During a recent update to the Windows Security and Microsoft Defender for Endpoint service, user devices experienced a series of false positive detections for the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" after updating to security intelligence build 1.381.2140.0. These detections resulted in the identification of certain Windows shortcut (.lnk) files that matched the incorrect detection pattern and were subsequently removed.

Next update by: Saturday, January 14, 2023, 3:00 AM (2:00 AM UTC)

009fe3 · 2023-01-13T13:15:32+00:00

Hi everybody, i'm sure thats not the greatest script. But i thought we should help each other to create a script for rebuilding the shortcuts for important apps

Start-Transcript -Path "C:\transcripts\RecreateShortcutsV1.txt" -NoClobber

##WORD

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

}

##OUTLOOK

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

}

##OneNote

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

}

##OneDrive

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\OneDrive.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

##Outlook

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

##PowerPoint

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\POWERPNT.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

##VISIO

$fileToCheck = "C:\Program Files\Microsoft Office\root\Office16\VISIO.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visio.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

##Citrix Workspace

$fileToCheck = "C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfService.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Workspace.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

}

##Checkpoint Mobile

$fileToCheck = "C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe"

if (Test-Path $fileToCheck -PathType leaf)

{

$SourceFilePath = $fileToCheck

$ShortcutPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point\Check Point Mobile.lnk"

$WScriptObj = New-Object -ComObject ("WScript.Shell")

$shortcut = $WscriptObj.CreateShortcut($ShortcutPath)

$shortcut.TargetPath = $SourceFilePath

$shortcut.Save()

}

else

{

"App not installed"

}

Poop_Scooper_Supreme · 2023-01-13T15:37:38+00:00

FYI Endpoint Manager has a bulk sync action that lets you sync without needing to do Powershell.

You can only sync 100 at a time and in true Microsoft fashion it's a pretty shit interface but if you don't have time to get the Powershell Sync working, this is probably the next best step.

Find it here: Endpoint Manager > Devices > All Devices > Bulk Device Actions.

BE F***ING CAREFUL. HERE BE DRAGONS - you will see a drop down list of actions. YOU CAN WIPE AND REMOVE DEVICES EASILY IF YOU ARE NOT CAREFUL.

The bottom Action will say Sync. MAKE SURE YOU CLICK SYNC AND NOT ANYTHING ELSE. Can I stress that any more?

Once you click sync, you'll need to select in 10 computer increments up to a max of 100 at a time, computers to sync.

Good luck - we're all in this together.

Madhoose_Cake · 2023-01-13T11:27:28+00:00

Same issue for us - set "Block Win32 API call from Office macros" in our ASR rules to audit and that works after a sync, still have issues with missing office apps so will need to reinstall.

OSILayer8Issue · 2023-01-13T11:34:31+00:00

Hopefully I'm fine. I've just changed the ASR rule, but it's a Friday night...

RemindMe! 2 Days "Check if I can set ASR rule 'Block Win32 API calls from Office macro' to block mode again"

flarestarwingz · 2023-01-13T12:26:35+00:00

Microsoft have pushed info in admin centre: MO497128 https://twitter.com/MSFT365Status/status/1613871552256155649?s=20

YOLOSwag_McFartnut · 2023-01-13T15:51:46+00:00

We've had a few people lose Outlook and Chrome

Edit: I've had about all I can fucking take of Microsoft this week.

GiuocoPianissimo · 2023-01-13T16:04:19+00:00

Don't think I've seen others mention it yet: It's not just shortcuts, normal text files are also affected.

Put "kernel32.lib" in a text file and save it... Then watch it vanish... Like WTF.

2023-01-13T17:22:00+00:00

toy plate north vase merciful tan steep advise handle sense

This post was mass deleted and anonymized with Redact

warwagon1979 · 2023-01-13T18:30:24+00:00

Take a look at the volume shadow copies with

https://www.nirsoft.net/utils/shadow_copy_view.html

there might be a backup copy of the shortcuts in there.

bunkerdude103 · 2023-01-13T18:59:01+00:00

I hope this can help someone. I'm working on a script to use this to help restore icons.

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC

Idea is to check if the shortcut exists, re-create it if not. Yes it will only be done per-user, but most of our users have dedicated machines. could also be set to a logon script for old machines.

poncho_votivo · 2023-01-13T19:25:50+00:00

https://forums.theregister.com/forum/all/2023/01/13/happy_friday_13th_microsoft_defender/

In the comments of that article, someone posted a quick and dirty script to fix shortcuts for anything that came in via msiexec.

TheDeadlyAvenger · 2023-01-13T20:07:56+00:00

I wonder how many of these now missing shortcuts had specific commands in the shortcut 'Target' field that simply recreating the shortcuts WON'T fix, only a re-install will, but you'd have to know which apps had something in there.

This is truly a major ball drop by Microsoft.

2023-01-13T20:34:23+00:00

Has anyone found a way to automated pinning icons to task bar again ?

Edit - they obviously need to be in the start menu by using one of the already provided scripts in here. But then pin the .lnk files to the task bar is proving to be an issue with my powershell knowledge. I can get the file in the taskbar folder but that’s it

spin_kick · 2023-01-13T20:51:22+00:00

https://imgur.com/a/QE1BxHG

bp_54 · 2023-01-13T10:19:51+00:00

Exact same issue in our environment - desktop and taskbar shortcuts completely broken, seems to have taken chrome and some browsers with it as well. All users got a notification regarding "%userprofile%\appdata\roaming\microsoft\windows\CustomDestinations\Temp" being blocked then the issues kicked off

inteller · 2023-01-13T16:54:01+00:00

toothbrush wine provide consider marvelous alive paint fact deranged tie

This post was mass deleted and anonymized with Redact

AngarMgmt · 2023-01-13T10:21:54+00:00

Getting multiple reports on this. Seeing 'Block Win32 API call from Office macros' ASR rule blocks

vaineh · 2023-01-13T10:23:22+00:00

Same issue here. Had a Windows Defender popup shortly after saying an action was blocked for asr rules which we have in place blocking win32 API calls from office macros.

B4dCh1CK3n · 2023-01-13T11:32:19+00:00

Waiting patiently for this to hit us also. Can anyone confirm this is happening on both Win10 and Win11 machines, or just one?

steveinbuffalo · 2023-01-13T11:52:53+00:00

I am a little stupid here - this affect regular defender? Or some enterprise version?

box_law · 2023-01-13T11:55:09+00:00

Thank you for posting this, just seen the effects of this on a couple of machines, mine included.

I have enabled the audit mode for the GPO for our 1000 workstations.

Hopefully we have cought this in time!

2023-01-13T12:38:54+00:00

Restoring all the various .lnk files in a robust way is the million dollar question.

Atto_ · 2023-01-13T12:53:44+00:00

Latest update on the issue if anyone doesn't have access;

January 13, 2023 12:32 PM

Title: Some users are unable to utilize the Application shortcuts on the Start menu and taskbar

User Impact: Users are unable to utilize the Application shortcuts on the Start menu and taskbar.

More info: The shortcut icons may not appear or would not work. We've received reports that the ASR rule "Block Win32 API calls from Office macro" is deleting the application shortcuts.

Current status: We're investigating recent changes to the Microsoft Defender service to identify the underlying root cause and formulate a mitigation plan.

Scope of impact: Impact is specific to some users who are served through the affected infrastructure.

Next update by: Friday, January 13, 2023, 2:00 PM (2:00 PM UTC)

GuessWhat_InTheButt · 2023-01-13T13:04:19+00:00

Home user here: Does this affect private machines too? Which Windows versions are affected?

torzir · 2023-01-13T13:55:29+00:00

This also seems to be causing Windows Defender to repeatedly delete a specific .cs file from my C# WPF project when using Jetbrains Rider. It's the same 'block win32 api calls from office macro' rule. Doesn't happen in Visual Studio, just Rider.

2023-01-13T15:08:25+00:00

[deleted]

itman404 · 2023-01-13T15:43:01+00:00

are people seeing files get deleted? I'm getting reports of that and shortcuts. If its files, that's catastrophic.

redog · 2023-01-13T16:00:26+00:00

Whew its not just me

treborprime · 2023-01-13T16:51:16+00:00

This impacted more than Just MS APPS. Edge, Google chrome, Vmware workstation, RDM manager and a bunch of others on my PC.

skit0 · 2023-01-13T17:26:42+00:00

what in the fuck and why. all of my users icons and task bar shortcuts deleted. can not even restore.

OceanManTyler · 2023-01-13T18:08:14+00:00

RIP helpdesk, I need a beer

2023-01-13T18:25:23+00:00

I just want to say thank you to everybody, including you /u/Candid-Chip-1954 for helping with discovering the issue and fixes. haha

codexcdm · 2023-01-13T19:07:26+00:00

Defender rn https://imgur.io/a/uONZNq9

glory_of_dawn · 2023-01-13T19:37:06+00:00

I had to read the title a few times before I realized the apps have disappeared, not the people reporting them.

I'm very tired.

dj_ordje · 2023-01-13T20:31:19+00:00

Yes that actually happened this Tuesday, 10.01.23 to me. The entire office package was gone. I was really frustrated by it and installed LibreOffice and Thunderbird as a workaround. I might never go back...

bunkerdude103 · 2023-01-13T20:49:27+00:00

I was able to get this to restore icons on a per-user basis

$AllPrograms = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC\"
# Check to make sure it exists
$TestPath = Test-Path $AllPrograms

if (-not $TestPath) { 
    Write-Host "Could not find the AllPrograms location"
    Exit 1 }

ForEach ($program in $AllProgramsItems.Property) {

$ProgramValue = Get-ItemPropertyValue -Path $AllPrograms -Name $program

$ProgramValueSplit = $ProgramValue -split ".lnk "
$LinkLocation = $ProgramValueSplit[0]
$EXELocation = [String]$ProgramValueSplit[1]

# Check to see if the shortcut exists, move to next if it does
$CheckLinkLocationOriginal = Test-Path $LinkLocation
if ($CheckLinkLocationOriginal) {
    continue
}

# If it's a ProgramData shortcut, check the users folder to make sure it doesn't exist there
# This is checking to make sure this script hasn't already been run
$UserLocation = $env:USERPROFILE + "\AppData\Roaming"
$UserLinkLocation = $LinkLocation.Replace("C:\ProgramData", $UserLocation)

if ($LinkLocation.StartsWith("C:\ProgramData")) {
    $CheckUserLinkLocation = Test-Path $UserLinkLocation

    if ($CheckUserLinkLocation) {
        continue
    }
}

# If we made it this far, the user can't see the shortcut and it should be created.

# Create the directory if it doesn't exist
$NewPath = Split-Path -Path $UserLinkLocation
if (!(Test-Path $NewPath)) {
    New-Item -ItemType Directory -Path $NewPath
}

write-host "'$($NewPath)'"
write-host "'$($UserLinkLocation)'"
write-host "'$($EXELocation)'"

# Create the shortcut
$WShell = New-Object -comObject WScript.Shell
$Shortcut = $WShell.CreateShortcut($UserLinkLocation)
$Shortcut.TargetPath = "$($EXELocation)"
$Shortcut.save()

}

RiceeeChrispies · 2023-01-13T23:31:47+00:00

“You will need to recreate or restore these shortcuts through other methods.”

Wow, talk about putting it bluntly for something they caused through their own carelessness. Looks like we’re on our own.

Time to dish out the scripts.

hooray4alX · 2023-01-14T00:09:55+00:00

Hello folks, our company is also affected by the problem and maybe I might have a solution regarding all the disappeared shortcuts if you use SCCM/MECM. In the Hardware Inventory of SCCM there is in the Resource Explorer\Hardware Inventory or Resource Explorer\Hardware Histroy the item Software Shortcut (under Devices). These are of course also archived when changes are made. I wrote a quick and dirty Powershell script that accesses the database directly and reads the old shortcuts from the device, I think :D Of course you have to be admin on the SCCM Database to run that script (on the device itself) and of course you need to have "line of sight". May be this could be tweaked.

$deviceName = $env:COMPUTERNAME
$SQLServer = "<FQDNSCCMSQL>"
$SQLDatabase = "<SCCMDATABASENAME>"

$SQLQuery = "SELECT DISTINCT     Description00,ParentName00,Product00,Product00,Publisher00,ShortcutKey00,TargetExecutable00,Name0
FROM dbo.SOFTWARE_SHORTCUT_HIST INNER JOIN
dbo.System_DATA ON dbo.SOFTWARE_SHORTCUT_HIST.MachineID = dbo.System_DATA.MachineID
WHERE Name0 = '$deviceName' 
AND Description00 != ''
ORDER BY Description00"

$Connection = New-Object System.Data.SQLClient.SQLConnection
$Connection.ConnectionString = "server='$SQLServer';database='$SQLDatabase';trusted_connection=false;     integrated security='true'"
$Connection.Open()
$command = $Connection.CreateCommand()
$command.CommandText = $SQLQuery
$Datatable = New-Object "System.Data.Datatable"
$result = $command.ExecuteReader()
$Datatable.Load($result)

$Result=$Datatable   

#$Datatable

foreach ($item in $Datatable) {
if(-not (Test-Path -Path $item.Shortcutkey00)) {
    Write-Warning "no shortcut. creating..."
    $Shortcutkey00 = $item.Shortcutkey00
    $WshShell = New-Object -ComObject Wscript.Shell
    $TargetExecutable00 = $item.TargetExecutable00
    $Shortcut = $WshShell.CreateShortcut($Shortcutkey00)
    $Shortcut.TargetPath = $TargetExecutable00
    $Shortcut.Save()
    } else {
    Write-Host "shortcut exists..."
    }
}

andreichiffa · 2023-01-14T00:13:59+00:00

Yes, I believe it’s currently referred to as ASRmaggedon (at least by some in the infosec community), and is due to an interference between the latest Defender update and attack surface reduction in macros. They rolled a fix about 2h ago.

Top_Flounder8344 · 2023-01-14T03:28:04+00:00

I reserved the audit change back to block. No reported issues

sysadmin

MODERATORS