Windows 10: Microsoft Script to restore (some) deleted Windows shortcuts after Defender ASR incident

News broke on Friday the 13th that Windows users from all over the world were noticing that application shortcuts on the taskbar and Start Menu were no longer accessible.



Microsoft confirmed the issue quickly and identified a security intelligence update build as the culprit for the issue. The company stopped the update and published a new fixed build that it released shortly thereafter.

Back then, Microsoft stated that users and administrators were on their own regarding the lost shortcuts. Now, it appears, that Microsoft has created a solution to resolve the issue on impacted systems.

In an update to Friday's Tech community post about the issue, the company says that it has "confirmed steps that customers can take to recreate start menu links for a significant sub-set of the affected applications that were deleted".

Microsoft created a PowerShell script that helps Enterprise administrators in recovering shortcuts on systems that they manage.

Note: while the script has been created for Enterprise administrators and Enterprise environments, it may also run in other environments; this has not been tested, but affected users may want to give it a try if they experienced the issue.

The Script is available on GitHub and includes a, rather short, list of applications and their executable files. The list is dominated by Microsoft applications, but administrators find third-party apps such as Notepad++, 7-Zip, Firefox, or Camtasia Studio as well in the listing.

The script queries a key in the Registry to determine if the listed programs are installed on the system. If they are, it checks if the shortcut exists, and if that fails, will create it.

Administrators may modify the script to add more applications to the listing. All that is required for that is to add a new line to the list of applications array using the provided syntax (which merely is "Application Name" = "filename").

The PowerShell script needs to be run with elevated privileges, either as admin or system, according to Microsoft. Instructions on running the script using Microsoft Intune are available on this GitHub page.

Administrators may also restore shortcuts manually by running application repairs on affected applications. Microsoft 365, Microsoft Edge and Microsoft Visual Studio include application repair functionality.

Administrators may run advanced hunting queries to determine the impact of the issue on their environment. Microsoft lists the available queries here. Basically, the queries retrieve events, block or otherwise, that were triggered by the broken ASR rule.

Closing Words

Microsoft's script offers limited assistance in fixing the issue. The script includes only 33 applications by default and restores shortcuts only in Start and not on the taskbar.

While administrators may add more programs to the listing, it is not an ideal solution. The script may not always restore shortcuts according to comments published by some users on the Tech community webpage.

All in all, it seems that many administrators are on their own when it comes to recovering shortcuts in their environments.

Thank you for being a Ghacks reader. The post Microsoft Script to restore (some) deleted Windows shortcuts after Defender ASR incident appeared first on gHacks Technology News.

read more...

 

Windows Defender Released

Microsoft has released the final version of its Windows Defender anti-spyware utility. Windows Defender is a product of the Microsoft acquisition of GIANT Software. Previously known as Windows AntiSpyware, after a two years beta period it's now available for Windows XP and Windows Server 2003 under the name Windows Defender. Windows Defender incorporates Real-Time Protection to monitor systems for spyware activity, automated spyware removal with scheduled scans, full integration with Internet Explorer 7.0 and automatic spyware definition updates from Microsoft. Windows Defender is available freely to all customers running a genuine copy of Windows. Microsoft has also announced that customers will each be allowed to report two support incidents for free with Windows XP and Windows Server 2003.

Source: DailyTech

 

Better free alternative to microsoft defender?

Windows Defender, Bill?

Yeah. Same thing. Definitions to stay up to date on threats of course, but thats really just a list of tricks and signatures.

You don't have to be. You just have to be smart enough to break their shit. You can take it apart and reverse engineer it and marvel later (I was impressed by a clients just recently). It's not hard to be up to date enough to keep malware a.) mostly off your machine in the first place and b.) limit it's damage when it does appear to your machine via network and best practices.

Some may call my approach inconvienient, but it DOES work.

 

Shortcuts and taskbar item disappeared and not findable in Start menu

> Buggy Microsoft Defender ASR rule deletes Windows app shortcuts

> https://twitter.com/MSFT365Status