After Defender bug: Microsoft script restores shortcuts

Microsoft provides a script that restores shortcuts deleted by Defender due to a broken ASR rule. The problem made the rounds on Friday the 13th of all days and caused chaos for many companies.

Now there is also help for the deleted shortcuts. Microsoft has released Advanced Hunting Queries (AHQs) and a PowerShell script to restore some of the Windows application shortcuts that were recently deleted by a corrupt Microsoft Defender ASR rule.

This rule actually detects and blocks malware that uses VBA macros to call Win32 APIs. However, a bug in the updated rules caused Microsoft Defender to return false positives and delete application shortcuts on the desktop, Start menu, and Windows taskbar.

update revised

The faulty update has already been stopped and restarted with changes. However, what this update couldn’t do is bring back the deleted shortcuts. This broken rule caused disruptions in corporate environments as users were unable to launch their applications quickly and Windows administrators struggled to restore the shortcuts. “Microsoft has confirmed steps customers can take to restore Start menu shortcuts for a significant subset of affected applications that were deleted,” Microsoft said in a new support document.

PowerShell script started

“These have been summarized in the PowerShell script below to assist enterprise admins in performing recovery actions in their environment.” Administrators can find details on this at Microsoft support.

See also:

Security, Security, Malware, Antivirus, Cybersecurity, Anti-Virus, Windows Defender, anti-malware, Defender, Antivirus Software, Microsoft Defender, Anti-Virus Software, Windows Defender Advanced Threat Protection, Windows Antivirus, Windows Defender Security Center, Windows Shield