How to Block Executable Content from Email & Webmail (Windows Server 2025)

Executable files delivered through email or webmail are a common attack vector. In this guide, I’ll walk you through how to use Group Policy + Attack Surface Reduction (ASR) to block them effectively in a domain environment.

📌 Why This Matters

Blocking executables from email clients and webmail helps:

• Reduce malware and ransomware risks
• Strengthen endpoint security
• Enforce safer user behavior

⚙️ Step-by-Step Configuration

1️⃣ Open Group Policy Management

• Go to Server Manager
• Navigate to Tools > Group Policy Management
• Select your domain (e.g., xitiztechservices.local)

2️⃣ Create a New GPO

• Go to your OU (e.g., Domain_Users)
• Right-click → Create a GPO in this domain, and link it here
• Name it: Block Executable Content From Email Client and Webmail

3️⃣ Edit the GPO

• Right-click the Block Executable Content From Email Client and Webmail GPO → Edit

4️⃣ Navigate to ASR Settings

Computer Configuration 
> Administrative Templates 
> Windows Components 
> Microsoft Defender Antivirus 
> Microsoft Defender Exploit Guard 
> Attack Surface Reduction        

5️⃣ Configure ASR Rule

• Open: Configure attack surface reduction rules
• Set to Enabled

👉 Click Show under: Set the state for each ASR rule

Add the following:

• Value Name (GUID): 3B576869-A4EC-4529-8536-B80A7769E899
• Value: 1 (Block)

📌 This GUID specifically blocks executable content from email clients and webmail.

6️⃣ Apply the Policy

Run on both server and client:

gpupdate /force        

🔄 Restart the client machine

🧪 Testing

Try opening an .exe file from email or web download.

🚫 Expected result:

This app can't run on your PC
To find a version for your PC, check with the software publisher.        

✅ Final Thoughts

This is a simple yet powerful security hardening step using built-in Microsoft Defender capabilities.

Implementing ASR rules like this can significantly reduce your organization's attack surface without requiring third-party tools.

#CyberSecurity #WindowsServer2025 #GroupPolicy #MicrosoftDefender #ASR #ITSecurity #SysAdmin #EndpointSecurity