Windows Defender ASR blocking msedgewebview2.exe for an EXCEL plugin

Question

Windows Defender ASR blocking msedgewebview2.exe for an EXCEL plugin

Zach 106

We have an issue where an ASR rule "Block all Office applications from creating child processes" keeps blocking this S&P CapIQ plugin that Excel uses and prevents the user from being able to leverage the app properly.

here are some screenshots of the timeline section in the defender portal:

User's image

we have tried to add it as an exclusion as below, but no matter what type of exclusion even if we do the directory, it still fails.... and blocks the plugin.

User's image

any suggestions on how we can get this to work? why does ASR so sensitive and not as friendly when it comes to the excludes, it doesn't really seem to make much sense.

Ziggy Kowalski 1 Reputation point

2023-07-06T18:24:14.58+00:00

We have this same issue, were you able to find a resolution?
Paul Costello 0 Reputation points

2023-07-06T18:39:50.42+00:00

I’ve had the same problem with an outlook plugin. Tried per ASR rule and global exception. The ASR rule still blocks it but not for everyone. I have about 700 users currently and it happens to some but not all and all use the application the same. In the end I had to put the ASR rule into audit mode… MS any answer? Been going on for months!
Ziggy Kowalski 1 Reputation point

2023-07-12T17:31:55.22+00:00
I was able to get to this to work by using the ASR Only Per Rule Exclusions

For Block all Office applications from creating child processes I added:

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\MSEdge*\msedgewebview2.exe

For Block Office applications from injecting code into other processes I added:

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\MSEdge*\msedgewebview2.exe

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\SNL.Clients.Office.Host.exe

That has allowed the add-in to work without issue

1 answer

Your answer

Ziggy Kowalski 1 Reputation point

2023-07-06T18:24:14.58+00:00

We have this same issue, were you able to find a resolution?
Paul Costello 0 Reputation points

2023-07-06T18:39:50.42+00:00

I’ve had the same problem with an outlook plugin. Tried per ASR rule and global exception. The ASR rule still blocks it but not for everyone. I have about 700 users currently and it happens to some but not all and all use the application the same. In the end I had to put the ASR rule into audit mode… MS any answer? Been going on for months!
Ziggy Kowalski 1 Reputation point

2023-07-12T17:31:55.22+00:00

I was able to get to this to work by using the ASR Only Per Rule Exclusions

For Block all Office applications from creating child processes I added:

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\MSEdge*\msedgewebview2.exe

For Block Office applications from injecting code into other processes I added:

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\MSEdge*\msedgewebview2.exe

C:\Program Files\SP Global Market Intelligence\SP Capital IQ Office\SNL.Clients.Office.Host.exe

That has allowed the add-in to work without issue

Answer 1

Rahul Jindal [MVP] 10,911 MVP

Does the actiontype actually say block? Where are you configuring the exclusions in ASR? Per rule or all?

Zach 106 Reputation points

2023-01-30T15:34:25.6033333+00:00

yup action type says block since we have our ASR rule set to block.

we are configuring the ASR exception under Microsoft Endpoint Manager, Endpoint Security section
Zach 106 Reputation points

2023-02-10T16:24:57.1166667+00:00

any further ideas?
Guillaume AMGAR 6 Reputation points

2023-02-17T09:20:38.4966667+00:00

Hi did you find a solution (same issue with our Factset Excel plugin that is blocking Excel from running

Share via

Windows Defender ASR blocking msedgewebview2.exe for an EXCEL plugin

1 answer

Your answer