Microsoft has issued an update for Windows Security and Microsoft Defender for Endpoint that managed to set off a series of false positive detections, remove the start menu, and delete all taskbar shortcuts.
Microsoft confirmed the chaos, writing:
“On January 13th, Windows Security and Microsoft Defender for Endpoint customers may have experienced a series of false positive detections for the Attack Surface Reduction (ASR) rule “Block Win32 API calls from Office macro” after updating to security intelligence builds between 1.381.2134.0 and 1.381.2163.0.”
“These detections resulted in the deletion of files that matched the incorrect detection logic primarily impacting Windows shortcut (.lnk) files.”
Impacted customers are being told by Microsoft to install both the updated security intelligence build (1.381.2164.0 or later), and to run a script to recover the deleted files.
Online commentators are complaining this process is overly complicated for novice users, and doesn’t actually fix all the issues caused by the dodgy update.
does not appear to be a complete fix – still getting alerts even if the taskbar and start menu short cuts are not being killed after repairing office install pic.twitter.com/gN84j0zaZ3
— Anthony Somerset (@anthonysomerset) January 13, 2023
Microsoft responded with a manual step-by-step to recover the deleted files.
“For customers that prefer manual steps rather than the script running an application repair on affected applications will recreate deleted links. Users can run the Application Repair functionality for programs including Microsoft 365, Microsoft Edge, and Microsoft Visual Studio.”
To repair an application, follow these instructions:
Windows 10:
Select Start > Settings > Apps > Apps & features
Select the app you want to fix.
Select Modify link under the name of the app if it is available.
A new page will launch and allow you to select repair.
Windows 11:
Type “Installed Apps” in the search bar.
Click “Installed Apps”.
Select the app you want to fix.
Click on “…”
Select Modify or Advanced Options if it is available.
A new page will launch and allow you to select repair.
