![](https://pariswells.com/blog/wp-content/uploads/2024/06/image-24.png)
Trying to open attachment from Outlook brings up ” Action Blocked – Your Administrator caused Windows Security to block this action” Contact your Help desk
Looking in the defender logs , Outlook was triggering the ASR rule “Block Office from creating child processes“
Defender UI had enabled this so I had to whitelist the pdf reader from the Rule :
Add-MpPreference -AttackSurfaceReductionOnlyExclusions “<fully qualified path or resource>”