#asrmageddon — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #asrmageddon, aggregated by home.social.
-
Follow-up to #ASRmageddon (deleted shortcuts in #Windows due to an ASR rule and triggered by a broken Defender update). Why home users with #DefenderUI were affected and how to get the .lnk files back.
-
Nachlese zu #ASRmageddon (gelöschte Verknüpfungen in #Windows auf Grund einer ASR-Regel und getriggert durch ein kaputtes Defender Update). Warum Privatanwender mit #DefenderUI betroffen waren und wie man die .lnk-Dateien zurück bekommt.
-
OK, #Microsoft wants to buy #ChatGPT. All of a sudden, #ASRmageddon makes a lot more sense.
https://www.reuters.com/technology/microsoft-talks-invest-10-bln-chatgpt-owner-semafor-2023-01-10/
-
A #powershell wizard (Harm Veenstra) made this: scrips to recreate start menu shortcuts. Haven’t tried it (did not experience #ASRmageddon myself).
Might be helpful.
(Check out his blog powershellisfun.com)
https://powershellisfun.com/2023/01/13/recreate-start-menu-shortcuts-asrmageddon/
-
r/sysadmin – Comment by u/DanielThiberge on ”Multiple use…
A way to work around the #ASRmageddon f%#ery that MS Defender and InTune janked out on us today…
-
If anyone was going to be hit by #ASRmageddon, I'm relieved it was my VM and not my remote CEO. Luckily, I had a VM backup from last week. After a HD image restore, I was back in business.
-
I keep reading #ASRmageddon as ASMR-mageddon sorry not sorry
-
It's the official #ASRmageddon logo, no rights reserved
-
Microsoft are still trying to roll back #ASRmageddon
-
Well, thanks to #ASRmageddon I can see a lot more of my desktop wallpaper than I could this morning. Sympathies to those spending the weekend working on it :(
-
@GossiTheDog We've been hit by it, absolute nightmare, I thought we'd managed to dodge it some how but then the calls started, what a great Friday 😂
#ASRmageddon -
Spoken to a bunch of UK orgs in healthcare and policing who are dealing with #ASRmageddon just now. Status: 😬😬😬😬🫡🤣
Everybody is dreading Monday, when people try to relaunch apps.
-
Today I am SO glad my servers are all Linux and my work laptop also runs Linux.
-
Feels good to be a Linux user today :blobcatcoffee: #ASRmageddon
-
One of the impacted #ASRmageddon orgs is.. Microsoft.
-
Friday the 13th becoming #ASRmageddon ... you couldn't even make this up if you tried.
-
-
If you want to find out if you have the ASR rule enabled and on which devices:
security.microsoft.com -> Vulnerability Management -> Recommendations -> Search (right hand side) for Win32 -> look for "Block Win32 API calls from Office macros"
It's not enabled by default, but Defender prompts to enable and Microsoft Security Baselines for 21H2 tell you to enable it.
It looks like they're rolling it back, a rule had been pushed which triggered the ASR rule in error on any app. #ASRmageddon
-
#Microsoft #Defender is having an issue with its latest update (link will follow)
They say they've stopped it currently but you may want to check if you're potentially effected:Get-MPpreference|select -expandproperty AttackSurfaceReduction_ids
If 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b is present
Run get-mppreference|select -expandproperty AttackSurfaceReduction_rules
If there is a "1" in the field, it's set to block and you MAY be effected.
-
MS have acknowledged #ASRmageddon in the M365 admin portal.
-
Teaching students to properly configure their alarm notifications to prevent alerting fatigue by night.
Clicking through Windows Defender warnings every few minutes by day.
#ASRmageddon -
They're tracking the problem under MO497128 #ASR #defender #defender
"workaround" is to set the Office Macro Win32 System Calls rule to audit only #ASRmageddon