{"id":8065,"date":"2024-06-28T00:26:19","date_gmt":"2024-06-28T00:26:19","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=8065"},"modified":"2024-06-28T00:26:20","modified_gmt":"2024-06-28T00:26:20","slug":"trying-to-open-attachment-from-outlook-brings-up-action-blocked-your-administrator-caused-windows-security-to-block-this-action","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/trying-to-open-attachment-from-outlook-brings-up-action-blocked-your-administrator-caused-windows-security-to-block-this-action","title":{"rendered":"Trying to open attachment from Outlook brings up &#8221; Action Blocked &#8211; Your Administrator caused Windows Security to block this action&#8221;"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2024\/06\/image-24.png\"><img loading=\"lazy\" decoding=\"async\" width=\"366\" height=\"223\" src=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2024\/06\/image-24.png\" alt=\"\" class=\"wp-image-8066 img-responsive\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2024\/06\/image-24.png 366w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2024\/06\/image-24-300x183.png 300w\" sizes=\"auto, (max-width: 366px) 100vw, 366px\" \/><\/a><\/figure>\n\n\n\n<p>Trying to open attachment from Outlook brings up &#8221; Action Blocked &#8211; Your Administrator caused Windows Security to block this action&#8221; Contact your Help desk<\/p>\n\n\n\n<p>Looking in the defender logs , Outlook was triggering the ASR rule &#8220;<em>Block Office from creating child processes<\/em>&#8220;<\/p>\n\n\n\n<p>Defender UI had enabled this so I had to whitelist the pdf reader from the Rule : <\/p>\n\n\n\n<p>Add-MpPreference -AttackSurfaceReductionOnlyExclusions &#8220;&lt;fully qualified path or resource>&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trying to open attachment from Outlook brings up &#8221; Action Blocked &#8211; Your Administrator caused Windows Security to block this action&#8221; Contact your Help desk Looking in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-8065","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=8065"}],"version-history":[{"count":1,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8065\/revisions"}],"predecessor-version":[{"id":8067,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/8065\/revisions\/8067"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=8065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=8065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=8065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}