Event ID 1121 Attack Surface Reduction Rule Block and How to Find the Rule

Event ID 1121 is written to the Microsoft-Windows-Windows Defender/Operational log when a Microsoft Defender attack surface reduction (ASR) rule blocks something. Microsoft's ASR event list describes it as "Event when rule fires in block mode". In Event Viewer the log is under "Applications and Services Logs" > "Microsoft" > "Windows" > "Windows Defender" > "Operational".

What it means

An ASR rule in block mode stopped a file or process on that machine. ASR rules run on Windows and depend on Microsoft Defender Antivirus. A block of a program your users need is a false positive. The fix is an exclusion for that program.

How to find the cause

List the latest block events on the affected machine with the time and message of each.

Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121 } -MaxEvents 20 | Select-Object TimeCreated,Message

Run the same command on a few other machines that got the same update or policy.

List the ASR rules set on the machine and the action for each. This is Microsoft's command from its ASR troubleshooting article.

$p = Get-MpPreference;0..([math]::Min($p.AttackSurfaceReductionRules_Ids.Count,$p.AttackSurfaceReductionRules_Actions.Count)-1) | % {[pscustomobject]@{Id=$p.AttackSurfaceReductionRules_Ids[$_];Action=$p.AttackSurfaceReductionRules_Actions[$_]}} | Format-Table -AutoSize

An action of 1 is block mode and 2 is audit mode. Match each ID to its rule in Microsoft's ASR rules reference. For example, "Block all Office applications from creating child processes" is d4f940ab-401b-4efc-aadc-ad5f3c50688a and "Block Adobe Reader from creating child processes" is 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c. Check that GUID values set through Group Policy have no extra characters such as quotation marks or spaces.

On devices onboarded to Microsoft Defender for Endpoint, open the device page in the Defender portal and check the "Effective settings" tab. It shows each rule's effective value and the source that set it. In advanced hunting, each rule has its own action types, such as AsrOfficeChildProcessBlocked and AsrOfficeChildProcessAudited for the Office child process rule.

To see what a rule would block on more machines before you change anything, set it to audit mode with the same method you used to deploy it. Audit mode writes event 1122 for each action the rule would have blocked.

Fixes

Add the blocked program as a per-rule exclusion so every other ASR rule still applies to it. In Intune, set the rule to "Audit", "Block", or "Warn" in the attack surface reduction rules profile, then add the path under "ASR only per rule exclusions". Use the full path and file name of the program, such as %ProgramFiles%\folder\file.exe.

In Group Policy, use "Apply a list of exclusions to specific attack surface reduction (ASR) rules" under "Computer configuration" > "Administrative templates" > "Windows components" > "Microsoft Defender Antivirus" > "Microsoft Defender Exploit Guard" > "Attack Surface Reduction". The value name is the rule's GUID. The value lists the paths separated by >, as in C:\Windows\Notepad.exe>C:\SomeFolder\test.exe.

Use a global ASR exclusion only when the program should skip every ASR rule. Add-MpPreference adds the path to the existing list, but Set-MpPreference would overwrite every ASR exclusion already set.

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Data\LOBApp\app1.exe"

Check the "Disable admin merge" setting before you add exclusions locally or through Intune or Group Policy. Microsoft documents that per-rule and local ASR exclusions don't apply on devices where it is set to true.

Report a block you think is wrong to Microsoft through the Microsoft Security Intelligence submission form.

Related events

• Event ID 1122, written when an ASR rule fires in audit mode.
• Event ID 1129, written when a user overrides a block in warn mode.
• Event ID 5007, written when Defender settings change.

Where ET Ducky shows it

I build ET Ducky. It isn't an antivirus engine and doesn't replace Defender, but its agent runs a behavioral rule engine against the live kernel event stream on every managed Windows and Linux endpoint. Beyond the fifteen built-in rules, you can create custom rules using a rule builder to monitor for events that are unique in your environment. Every rule can be tuned or disabled by organization members with security modifier privileges in their workspace. Configuration changes reach your agents through a pushed security policy, with no reinstall required.

Sources

• Microsoft Learn, View attack surface reduction events in Windows Event Viewer, read 2026-11-11.
• Microsoft Learn, Troubleshoot problems with attack surface reduction rules, read 2026-11-11.
• Microsoft Learn, Attack surface reduction rules reference, read 2026-11-11.
• Microsoft Learn, Enable attack surface reduction rules, read 2026-11-11.
• Microsoft Learn, Understand and use attack surface reduction capabilities, read 2026-11-11.
• Microsoft Learn, Test attack surface reduction rules, read 2026-11-11.
• Microsoft Learn, Get-WinEvent, read 2026-11-11.