Secure Exchanges encounters an error during the update

What to do in case of a Microsoft Office error during the Secure Exchanges update (ASR blockage)?

This article explains what to do when Microsoft Defender blocks the Secure Exchanges connector update in Outlook because of an attack surface reduction (ASR) rule, and how to configure targeted exclusions.

1. Context

Microsoft Defender includes a security rule called "Block executable content from email client and webmail" that blocks executable content from email clients. This rule blocks all content considered executable when it originates from an email or email client (Outlook, webmail, etc.).

Note: Secure Exchanges uses ClickOnce to deploy updates to C:\Users\[username]\AppData\Local\Apps\2.0\

ASR rule parameters

  • Rule name: Block executable content from email client and webmail
  • GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
  • Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)
Note: The blockage occurs during the Secure Exchanges connector update, not during the initial installation.

2. Identify the blockage in Microsoft Defender

2.1 Kusto query (Advanced Hunting)

To confirm that the ASR rule is responsible for the problem, use the following query in Microsoft 365 Defender > Advanced Hunting:

  • DeviceEvents
  • | where ActionType == "AsrExecutableEmailContentBlocked"
  • | where FileName contains "SecureExchanges"
  • | project Timestamp, DeviceName, FileName, FolderPath, SHA256
  • | order by Timestamp desc

2.2 Typical result

In the results, you will see:

  • ActionType: AsrExecutableEmailContentBlocked
  • FileName: SecureExchangesSDK.dll
  • FolderPath: C:\Users\[username]\AppData\Local\Apps\2.0\...

3. Why is SecureExchangesSDK.dll blocked?

Secure Exchanges uses a software component (DLL) to:

  • Manage secure communication between Outlook and the server
  • Confirm actions performed in Outlook (sending encrypted messages)
  • Process encrypted and decrypted messages
Note: This is not a real threat. It is a common false positive in secure environments.

4. Security principle: targeted exclusions

Warning: never exclude the entire folder C:\Users\*\AppData\Local\Apps\2.0\

ClickOnce stores all applications deployed through ClickOnce in this folder. By excluding this folder, you:

  • Disable ASR protection for all ClickOnce applications
  • Create a major security vulnerability
  • Allow an attacker to deploy malware through ClickOnce undetected

5. Understanding the types of ASR exclusions

Warning: the type of exclusion depends on your management tool. This distinction is essential for security.
  • Intune / MDE: per-rule exclusion. Applied only to the specific rule.
  • GPO: global exclusion. Applied to all active ASR rules.
  • MECM / SCCM: global exclusion. Applied to all active ASR rules.
  • PowerShell: global exclusion. Applied to all active ASR rules.

6. Files to exclude

The following paths must be added to the exclusions:

Secure Exchanges DLLs

  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\SecureExchangesSDK.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\OSecureExchange.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\*\OSecureExchange.resources.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\SecureExchangesSDK.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\OSecureExchange.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\SecureExchangesSDK.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\OSecureExchange.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\OSecureExchange.resources.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\*\OSecureExchange.resources.dll

PDF libraries (iText and PdfPing)

  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.*.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\UglyToad.PdfPig*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\UglyToad.PdfPig*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\itext.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\UglyToad.PdfPig*.dll

Third-party DLLs

  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\BouncyCastle.Cryptography.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\CsvHelper.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\Newtonsoft.Json.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\PhoneNumbers.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\BouncyCastle.Cryptography.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\CsvHelper.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\Newtonsoft.Json.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\PhoneNumbers.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\BouncyCastle.Cryptography.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\CsvHelper.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\Newtonsoft.Json.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\PhoneNumbers.dll

.NET Runtime ans VSTO

  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\Microsoft.*.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\System.*.dll
  • C:\Users\*\AppData\Local\Temp\Deployment\*\*\netstandard.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\Microsoft.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\System.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\netstandard.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\Microsoft.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\System.*.dll
  • C:\Users\*\AppData\Local\Apps\2.0\*\*\*\netstandard.dll
Note: Multiple wildcards (*\*\) are needed to cover the variable folder structure of ClickOnce.

7. Applying the exclusions

7.1 Through Intune

Note: Intune lets you configure per-rule exclusions (ASR Only Per Rule Exclusions), which limits the impact on overall security.
    1. Go to Endpoint Security > Attack Surface Reduction
    2. Select or create an ASR policy
    3. Locate the rule "Block executable content from email client and webmail"
    4. In ASR Only Per Rule Exclusions, add the paths from section 6
    5. Save and deploy the policy

7.2 Through GPO (enterprise deployment)

Note: Exclusions configured through GPO apply to all ASR rules, not only to the rule in question.
    1. Open gpedit.msc (or GPMC for a domain)
    2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
    3. Double-click "Exclude files and paths from attack surface reduction rules"
    4. Enable the policy and add the paths from section 6
    5. Apply the policy: gpupdate /force

7.3 Through PowerShell

Note: As with GPO, PowerShell exclusions are global and apply to all ASR rules.

To add an exclusion:

$dlls = @( 

    "SecureExchangesSDK.dll", "OSecureExchange.dll", 

    "itext.*.dll", "UglyToad.PdfPig*.dll", 

    "BouncyCastle.Cryptography.dll", "CsvHelper.dll", 

    "Newtonsoft.Json.dll", "PhoneNumbers.dll", 

    "Microsoft.*.dll", "System.*.dll", "netstandard.dll" 

) 

$prefixes = @( 

    "C:\Users\*\AppData\Local\Temp\Deployment\*\*", 

    "C:\Users\*\AppData\Local\Apps\2.0\*\*", 

    "C:\Users\*\AppData\Local\Apps\2.0\*\*\*" 

) 

foreach ($p in $prefixes) { 

    foreach ($d in $dlls) { 

        Add-MpPreference -AttackSurfaceReductionOnlyExclusions "$p\$d" 

    } 

} 

# Ressources localisées (sous-dossier de culture, ex. fr-CA) 

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\*\AppData\Local\Temp\Deployment\*\*\*\OSecureExchange.resources.dll" 

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\*\AppData\Local\Apps\2.0\*\*\*\OSecureExchange.resources.dll" 

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\*\AppData\Local\Apps\2.0\*\*\*\*\OSecureExchange.resources.dll" 

To check the current exclusions:


  • Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionOnlyExclusions

8. Verify that the exception works

  1. Wait for propagation (up to 90 minutes for GPO and Intune)
  2. Test a Secure Exchanges update on a workstation. This happens automatically when Outlook restarts.
  3. Check in Advanced Hunting whether any new blocks appear
  4. If no result is found, the exclusion is working correctly

9. If the problem persists

Possible causes

  • The exclusion was not applied correctly (check the syntax)
  • The GPO or Intune policy has not propagated yet
  • A conflict with another security policy

Troubleshooting actions

  1. Rerun the Kusto query to identify all blocked files
  2. Check whether new DLLs are blocked and add them to the exclusions
  3. Verify that the GPOs are applied: gpresult /h C:\temp\rapport_gpo.html
  4. Force an update: gpupdate /force

Microsoft references

Need help?

Our team is available to assist you. Write to us at support@secure-exchanges.com