# Risky action blocked

## Situation

Working with Attack Surface Reduction (ASR) rules can cause Windows to block KONNEKT performing some of it's main actions.

{% embed url="<https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference>" %}

## Problem

Without exclusion KONNEKT crashes when trying to open or preview an Office file e.g. Word, Excel or PowerPoint.

In this case check for entries under Windows Security / Protection History:

<figure><img src="https://2727108687-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8zLVuKYctMIUr68_fs%2Fuploads%2F5IdpXWUjcfWT8ykP93Ql%2Fimage.png?alt=media&#x26;token=c0f68880-7de7-408a-bc5c-e9acf89532d1" alt=""><figcaption></figcaption></figure>

## Solution

Exclude KONNEKT from the ASR rule "Office Child Process":

"C:\Program Files\Konnekt\Konnekt.exe"

"C:\Program Files\Konnekt\KonnektStarter.exe"

{% embed url="<https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-all-office-applications-from-creating-child-processes>" %}