Windows Defender deletes Desktop and Startmenu Shortcuts

Windows Defender deletes Desktop and Startmenu Shortcuts

A customer of mine distributes desktop shortcuts via GPO. As of today, these links are either not created at all or only partially.

After some research, it turned out that Windows Defender’s Attack Surface Reduction is to blame. Suddenly the shortcuts are recognized as Win32 API Calls (sorry for the german screenshot :-)).

Our current workaround is to disable the relevant Endpoint Security rule in Endpoint Manager until Microsoft has fixed the issue.

There is also a Microsoft Support Incident listed in Admin Portal: