Today I was getting Event ID 1121 in Windows Event Viewer while managing Windows Defender through Microsoft Intune. It took me a little bit of time to track down the exact cause as Microsoft have removed the GUIDs from the descriptions in the policy properties. I thought it would be a good idea to give an overview and include some useful references.

Background

Firstly, this blog applies to those running Attack Surface Reduction (ASR) through Microsoft Intune. These settings can be managed through Config Mgr or Group Policy but they are not in the scope of this post.

In this scenario, I have an ASR rule setup to point to a group of devices. The rule that I have setup, prevent Word from performing some legacy functions required in an old .Net 3rd party application. To fix the problem, the ASR rule needed to be changed.

Warning, make sure you have fully considered the consequences of lowering security rules in your organisation and always test before pushing live.

If you want to learn more about ASR rules, you can do some further reading from the Microsoft Docs Attack Surface Reduction Rules – Learn More | Microsoft Docs

The Problem – Event ID 1121

A third party application we use is producing this error in Event Viewer. The user is unable to use the application to retrieve the data they need.

This event information can be found here:

Event Viewer | Applications and Services Logs | Microsoft | Windows | Windows Defender | Operational

The details of the event show some very useful information. As you can see from the image below

If we unpack the details here, the key part is the ID which I have pointed directly at. This is what is going to tell you which part of the policy is affecting your users.

We can also confirm we have the correct error by checking the affected applications.

We can use this ID to work out the solution.

The Solution – Intune ASR Rules

Head over to Intune. Specifically in the Endpoint Security blade.

Endpoint Security | Attack Surface Reduction | Select your ASR rule for the affected device(s)

Select Properties and click Edit next to the Configuration Settings section

Now we need to use that ID from the event viewer details to determine the cause of the issue.

Unfortunately it looks like Microsoft have removed the GUID from the policy tip that used to appear next to each setting. So I have included a table below which should help navigate the policy easier.

In the GUID column you will find the ID from the Event Viewer entry details and in the Name you will find the name of the policy setting as it appears in Intune

To Fix

Once you have located the correct setting in the policy, you need to change it from Block to one of the other optional settings. You can change to

• Not Configured
• Block
• Audit Mode
• Warn [not available for all settings]

Warn is new and my favoured option here. This pops up a warning to the user that the action they are about to perform is risky. Gives them the chance to allow it. If they allow its, its only for 24 hours and then its automatically blocked again. The cycle will then repeat as many times as required.

After you have changed the setting, make sure you save the policy!

Remember

One thing you need to remember, once you have made a change in Intune, you need to sync your device settings.

You can hurry the process up by going to Settings | Accounts | Access Work or School | Click the connected Domain | Info | Sync

You may experience a delay for your settings to sync, I have seen this take 30 minutes plus, even with hitting the sync button.