# Preserve existing ASR exclusions when adding a PowerShell exception

> Which PowerShell operation changes one ASR exclusion without replacing the complete existing list?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:08+00:00
- Modified: 2026-09-17T16:38:44+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Which PowerShell operation changes one ASR exclusion without replacing the complete existing list?

## Potentially affected

Apply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.

## DSE recommendation

DSE recommends treating an addition, a removal, and full replacement as different change intentions.

## Article

## Source facts

For global ASR exclusions, Set-MpPreference replaces the existing exclusion values with those supplied in the command. Microsoft documents Add-MpPreference for adding values without changing existing entries, and Remove-MpPreference for removing specified entries while retaining others. These global path exclusions apply across ASR rules. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure).

## Applicability

Apply this check when an approved Windows ASR exception must be changed through PowerShell. Identify the governing management policy before making a local change, and keep the authorized scope in the change record.

## DSE recommendation

DSE recommends treating an addition, a removal, and full replacement as different change intentions. Capture the approved before-state, select the operation that expresses the intended change, and have a reviewer compare the resulting list with the exception register. Reserve full replacement for a reviewed complete list rather than a command containing only the new exception.

## Verification

In a controlled test, verify that the intended entry changes and unrelated approved entries remain as expected. Recheck the effective configuration after the normal management cycle. Retain the before-and-after lists in a restricted record and investigate any unexpected loss or reappearance before extending the change.

## Official references

[Microsoft Learn: Configure attack surface reduction (ASR) rules and exclusions](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure). Source reviewed September 17, 2026.

## Primary reference

- Name: Configure ASR rules and exclusions - Microsoft Defender for Endpoint | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-configure
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve existing ASR exclusions when adding a PowerShell exception,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-052-preserve-existing-asr-exclusions-when-adding-a-powershell-exception/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.