Why has Windows Defender started removing shortcuts on 13 January 2023?
Jan 13
All of a sudden, Windows Defender has removed loads of shortcuts (.lnk files) from our Windows 10 and 11 computers. Dozens of computers affected.
Shortcuts have disappeared from both the desktop folder and the taskbar - with most disappearing instantly when the user double clicks the icon. Presumably the issue is machine wide, just most shortcuts are found in these locations.
Some shortcuts are however not affected and others that have been removed can be recreated and may not be removed.
Very odd!!
1 answer
Accepted answer · original discussion
Jan 15
[Short answer to the question "Why has Windows Defender started removing shortcuts today (13/01/2023)?"]
This issue is resolved in security intelligence update build 1.381.2164.0. Installing security intelligence update build 1.381.2164.0 or later should prevent the issue, but it will not restore previously deleted shortcuts. You will need to recreate or restore these shortcuts through other methods. For additional information, see Recovering from Attack Surface Reduction rule shortcut deletions.
Note that
Affected devices have the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" enabled. After installing security intelligence build 1.381.2140.0, detections resulted in the deletion of certain Windows shortcut (.lnk) files that matched the incorrect detection pattern.
How to solve / avoid the problem
- Not installing the security intelligence update build 1.381.2140.0. (To prevent)
- Installing security intelligence update build 1.381.2164.0 or later. (To solve)
- Changing ASR rules to Audit Mode (It may help to prevent).
3 question comments
Use comments to ask for clarification. Post a solution as an answer.
Jan 13
Jan 14