How do I DISABLE Defender Block Suspicious Behaviors?

Attack Surface Reduction is back on my computer and causing major problems for me! (It was gone for the longest time.)

I need to rid this workstation of this behavior. I looked at the tutorials but I can't take possession of the ASR registry key in order to turn Attack Surface Reduction off.

Can anyone give me some ideas or detailed instructions?

21H2 / 19044.1469

- - - Updated - - -

Found a solution (I think) - downloaded and ran ConfigureDefender 3.0.1.0 - hoping it works for me.

steve108 said:

GitHub - AndyFul/ConfigureDefender: Utility for configuring Windows 10 built-in Defender antivirus settings. this? Never heard of it. What did you change or modify?

Hi Steve -

I clicked on DEFAULT just to make sure it was, then set:
> Block At First Sight to Disabled
> Automatic Sample Submission to Disabled (I don't want to submit samples as I do a lot of beta testing)
> PUA Protection to Disabled (I have programs that generate a positive)

Well that fix didn't last! Windows Defender went back in and said "Oh, you have an unsafe setting! We're changinging it back to what WE say is safe for you. Listen to mother Microsoft!"

...or words to that effect.

So, back to my question: can anyone help me gain ownership of the ASR file and allow me to make a registry change to turn it off?

Thanks, Bree. I'll give that switch a shot and see if it allows the configuration to stick. I'll know more in 4 hrs.