Secure Exchanges encounters an error during the update

Microsoft Office error during Secure Exchanges update (ASR blockage)


1. Context

Microsoft Defender includes a security rule called "Block executable content from email client and webmail" that blocks executable content from email clients. This rule blocks all content considered executable when it originates from an email or email client (Outlook, webmail, etc.).
Info Secure Exchanges uses ClickOnce to deploy updates to C:\Users\[username]\AppData\Local\Apps\2.0\
ASR rule parameters:
Setting
Value
Rule name
Block executable content from email client and webmail
GUIDE
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
Intune Name
Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)
Notes
The blockage occurs during the Secure Exchanges connector update, not during the initial installation.

2. Identify the blockage in Microsoft Defender

2.1 Kusto query (Advanced Hunting)

To confirm that the ASR rule is responsible for the problem, use the following query in Microsoft 365 Defender > Advanced Hunting:
Quote
DeviceEvents
| where ActionType == "AsrExecutableEmailContentBlocked"
| where FileName contains "SecureExchanges"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256
| Order by Timestamp Description

2.2 Typical result

In the results, you will see:
  1. ActionType : AsrExecutableEmailContentBlocked
  2. FileName: SecureExchangesSDK.dll
  3. FolderPath : C:\Users\[username]\AppData\Local\Apps\2.0\...

3. Why is SecureExchangesSDK.dll blocked?

Secure Exchanges uses a software component (DLL) to:
  1. Manage secure communication between Outlook and the server
  2. Confirm actions performed in Outlook (sending encrypted messages)
  3. Processing encrypted/decrypted messages
Info
This is not a real threat. It's a common false positive in secure environments.

4. Security principle: targeted exclusions

Alert
Never exclude the entire folder C:\Users\*\AppData\Local\Apps\2.0\
ClickOnce stores ALL applications deployed via ClickOnce in this folder. By excluding this folder, you:
  1. Disable ASR protection for all ClickOnce applications
  2. Create a major security vulnerability
  3. Allow an attacker to deploy malware via ClickOnce undetected

5. Understanding the types of ASR exclusions

Warning
Crucial point: The type of exclusion depends on your management tool. This distinction is essential for security.
Tool
Type of exclusion
Impact
Intune / MDE
Per-rule
Exclusion applied ONLY to the specific rule.
GPO
Global
Exclusion applied to ALL active ASR rules.
MECM / SCCM
Global
Exclusion applied to ALL active ASR rules.
PowerShell
Global
Exclusion applied to ALL active ASR rules.

6. Files to exclude

The following paths must be added to the exclusions:

Secure Exchanges core DLLs
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\SecureExchangesSDK.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\OSecureExchange.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\OSecureExchange.resources.dll

 C:\Users\*\AppData\Local\Apps\2.0\*\*\SecureExchangesSDK.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\OSecureExchange.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\OSecureExchange.resources.dll
iText DLLs
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.barcodes.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.bouncy-castle-adapter.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.bouncy-castle-connector.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.commons.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.forms.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.io.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.kernel.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.layout.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.pdfa.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.pdfua.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.sign.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.styledxmlparser.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\itext.svg.dll

 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.barcodes.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.bouncy-castle-adapter.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.bouncy-castle-connector.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.commons.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.forms.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.io.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.kernel.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.layout.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.pdfa.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.pdfua.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.sign.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.styledxmlparser.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\itext.svg.dll
Third-party DLLs
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\BouncyCastle.Cryptography.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\CsvHelper.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\Newtonsoft.Json.dll
 C:\Users\*\AppData\Local\Temp\Deployment\*\*\PhoneNumbers.dll

 C:\Users\*\AppData\Local\Apps\2.0\*\*\BouncyCastle.Cryptography.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\CsvHelper.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\Newtonsoft.Json.dll
 C:\Users\*\AppData\Local\Apps\2.0\*\*\PhoneNumbers.dll
Info
Multiple wildcards (*\*\) are needed to cover the variable folder structure of ClickOnce.

A. Application via Intune

Info
Idea
Intune allows you to configure exclusions per rule (ASR Only Per Rule Exclusions), limiting the impact on overall security.
  1. Go to Endpoint Security → Attack Surface Reduction
  2. Select or create an ASR policy
  3. Locate the rule " Block executable content from email client and webmail "
  4. In ASR Only Per Rule Exclusions , add the paths from section 6
  5. Save and deploy the policy

B. Application via GPO (enterprise deployment)

Info
Exclusions configured via GPO apply to ALL ASR rules, not just the rule in question.
  1. Open gpedit.msc (or GPMC for a domain)
  2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Microsoft Defender Exploit Guard → Reducing the Attack Surface
  3. Double-click on " Exclude files and paths from attack surface reduction rules "
  4. Activate the strategy and add the paths from section 6
  5. Apply the strategy: gpupdate /force

C. Application via PowerShell

Info
As with GPO, PowerShell exclusions are GLOBAL and apply to all ASR rules.
Add an exclusion:

Quote
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\*\AppData\Local\Apps\2.0\*\SecureExchangesSDK.dll"
Check current exclusions:

Quote
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionOnlyExclusions

7. Verify that the exception works

  1. Wait for propagation (up to 90 minutes for GPO/Intune)
  2. Testing a Secure Exchanges update on a workstation *This happens automatically when Outlook restarts
  3. Check in Advanced Hunting to see if any new blocks appear.
  4. If no results are found → The exclusion is working correctly

If the problem persists

Possible causes:
  1. The exclusion was not applied correctly (check the syntax).
  2. GPO/Intune has not yet been rolled out.
  3. A conflict with another security policy
Troubleshooting actions:
  1. Rerun the Kusto query to identify all blocked files
  2. Check if any new DLLs are being blocked and add them to the exclusions.
  3. Verify the application of the GPOs: gpresult /h C:\temp\rapport_gpo.html
  4. Force an update: gpupdate /force

Microsoft References

  1. Use attack surface reduction rules to prevent malware infection - Microsoft Defender for Endpoint | Microsoft Learn
  2. Reference information on attack surface reduction rules - Microsoft Defender for Endpoint | Microsoft Learn



    • Related Articles

    • Error adding a signature file or document with Secure Exchanges

      If an error occurs when you try to attach a file or document for signature in an email protected by Secure Exchanges, it usually means that the file is already being used by another application or is temporarily blocked by your antivirus software. In ...

    • Deploying Secure Exchanges via GPO/Intune on Outlook

      If you plan to deploy Secure Exchanges using Group Policy Objects (GPO) or Microsoft Intune, the necessary PowerShell scripts are available at the bottom of this article. For any questions, please contact us at support@secure-exchanges.com

    • How to activate an API license in Secure Exchanges

      Activating an API license allows you to use the advanced features of Secure Exchanges in your applications. Here are the steps to follow: You can find the API and SDK help documentation here: https://help.secure-exchanges.com 1. Log in to the online ...

    • What is Secure Exchanges' Refund and Upgrade Policy?

      At Secure Exchanges, we are committed to providing high-quality service to our customers. Please read our refund policy below: Free Trial Period We offer a free 30-day trial period so you can discover our services. During this period, you can explore ...