Windows 10’s Attack Surface Reduction (ASR) rules are part of Windows Defender ... change the setting from 2 (audit mode) to 1 (block mode) You then want to monitor for event ID 1122 in your ...