{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
        "slug": "dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/"
        },
        "title": "Preserve existing ASR exclusions when adding a PowerShell exception",
        "summary": "Which PowerShell operation changes one ASR exclusion without replacing the complete existing list?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:34:08+00:00",
        "modified_at": "2026-09-17T16:38:44+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 199,
        "potentially_affected": "Apply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.",
        "dse_recommendation": "DSE recommends treating an addition, a removal, and full replacement as different change intentions.",
        "primary_source": {
            "name": "Configure ASR rules and exclusions - Microsoft Defender for Endpoint | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>For global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. <a href=\"https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.</p>\n<h2>Verification</h2>\n<p>In a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Configure attack surface reduction (ASR) rules and exclusions</a>. Source reviewed September 17, 2026.</p>",
        "content_text": "Source facts\nFor global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. Microsoft Learn.\nApplicability\nApply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.\nDSE recommendation\nDSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.\nVerification\nIn a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.\nOfficial references\nMicrosoft Learn: Configure attack surface reduction (ASR) rules and exclusions. Source reviewed September 17, 2026.",
        "content_markdown": "## Source facts\n\nFor global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure).\n\n## Applicability\n\nApply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.\n\n## DSE recommendation\n\nDSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.\n\n## Verification\n\nIn a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.\n\n## Official references\n\n[Microsoft Learn: Configure attack surface reduction (ASR) rules and exclusions](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure). Source reviewed September 17, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Preserve existing ASR exclusions when adding a PowerShell exception",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/",
                "headline": "Preserve existing ASR exclusions when adding a PowerShell exception",
                "description": "Which PowerShell operation changes one ASR exclusion without replacing the complete existing list?",
                "abstract": "Which PowerShell operation changes one ASR exclusion without replacing the complete existing list?",
                "articleBody": "Source facts\nFor global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. Microsoft Learn.\nApplicability\nApply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.\nDSE recommendation\nDSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.\nVerification\nIn a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.\nOfficial references\nMicrosoft Learn: Configure attack surface reduction (ASR) rules and exclusions. Source reviewed September 17, 2026.",
                "datePublished": "2026-09-17T16:34:08+00:00",
                "dateModified": "2026-09-17T16:38:44+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Preserve existing ASR exclusions when adding a PowerShell exception"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 199,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure ASR rules and exclusions - Microsoft Defender for Endpoint | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure"
                }
            }
        ]
    }
}