Impossible to open .hta file after activating the Control Application (ARS / Intunes)

Question

Hi,

After activating the "Application Control" of ARS in Intunes, I can no longer run files with the .hta extension. I have no error messages or alerts in Defender.

I deleted the strategy to go back, the blockage persists.

Answer 1

@David B Thanks for your update.

If you want to configure this setting to "Not configured", it seems a workaround that try to find the registry key of this setting and then change the registry key to remove the setting.

If you want to make it via intune, it is needed to do the following actions:

1. Please remove the group in assignment of the Control Application policy.
2. Create a Powershell Script that can change the registry key of the target setting.
3. Deploy this script via intune.
   https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension

Hope it will give you some ideas.

Answer 2

@David B Thanks for posting in our Q&A. From your description, did you mean that you have removed the group in assignment, but this policy still worked? If there is anything unclear, please correct me.

For this issue, it seems that this policy is tattooed. Intune deploys policies based on the windows CSPs. The tattoo is an issue or limitation from Windows CSPs. For more details, please refer to the following link:
https://www.anoopcnair.com/intune-policy-tattooed-not-tattooed-windows-csp/
Note: Non-Microsoft link, just for the reference.

Thanks for your understanding.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi,

thank you for your feedback

Yes, we have removed the group in assignment

Answer 4

Hi @Lu Dai-MSFT ,

Thank you for these tips

I had other suggestions in parallel :
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/wdac-wizard
https://www.csoonline.com/article/3653316/using-windows-defender-application-control-to-block-malicious-applications-and-drivers.html (no Microsoft link)