Dyknow Classroom - Why is my Dyknow Windows agent installation failing?

If you encounter the message "Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator," it indicates that the installation has failed due to Attack Surface Reduction (ASR) rules being in place. Specifically, this issue arises with the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion." This rule prevents the MSI from unpacking temporary files to the User Profile's \AppData\Local\Temp\ directory.

To resolve this issue, you need to create an exception using Inclusions and the MSI's public certificate.

1. Extract the public certificate from the MSI file: Right-click the MSI -> Properties -> Digital Signatures tab -> Details -> View Certificate -> Details -> Copy to File.
2. Select the DER encoded binary X509 (.cer).
3. Navigate to the Indicators page in Defender for Endpoint (Settings -> Endpoints -> Indicators (under Rules)).
4. Add an Indicator using the extracted .cer file.

For more information on indicators, see https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-certificates?view=o365-worldwide