
After installing security intelligence build 1.381.2140.0, detections resulted in the deletion of certain Windows shortcut (.lnk) files that matched the incorrect detection pattern. Affected devices have the Atack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" enabled.
Additionally, errors might be observed when trying to run executable (.exe) files which have dependencies on shortcut files.
Client: Windows 11, version 22H2 Windows 11, version 21H2Īpplication shortcuts might not work from the Start menu or other locationsĪfter installing security intelligence update build 1.381.2140.0 for Microsoft Defender, application shortcuts in the Start menu, pinned to the taskbar, and on the Desktop might be missing or deleted. Note: If you are using any third-party UI customization app and encounter this or any other issues, you will need to contact customer support for the developer of the app you are using. Resolution: ExplorerPatcher has released a version which lists this issue as resolved. If you are using StartAllBack, you might be able to prevent this issue by updating to the latest version (v3.5.6 or later). If your Windows device is already experiencing this issue, you might need to contact customer support for the developer of the app you are using. Workaround: We recommend uninstalling any third-party UI customization app before installing KB5022913 to prevent this issue. These types of apps often use unsupported methods to achieve their customization and as a result can have unintended results on your Windows device. The known affected third-party UI customization apps are ExplorerPatcher and StartAllBack. These third-party apps might cause errors with explorer.exe that might repeat multiple times in a loop. Third-party UI customization apps might cause Windows to not start upĪfter installing KB5022913 or later updates, Windows devices with some third-party UI customization apps might not start up.