Cannot run the Agent Based restore after applying the Windows Security Baseline or enabling Attack Surface Reduction Rule (4243027)

Cannot run the Agent Based restore after applying the Windows Security Baseline or enabling Attack Surface Reduction Rule

After applying a Windows Security Baseline to the Domain Controllers, or after enabling the Attack Surface Reduction Rule, "Block credential stealing from the Windows local security authority subsystem", GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2, it is not possible to perform an Agent Based restore using the Online Restore Wizard.

An error similar to the following is shown in the Online Restore Wizard:

"Unable to install Online Restore Agent. Failed to install the agent. Access is denied. Make sure you have specified the correct access account. Access is denied."

The following error may also be logged in the Windows Application event log:

"EriAgent service terminated with the following error: Access is Denied"

The Attack Surface Reduction Rule "Block credential stealing from the Windows local security authority subsystem" (which is created by some Windows Security Baselines and will be enabled by default by Microsoft in the near future) prevents the agent from being able to access LSASS and inject dlls into the LSASS process.

1. Open an elevated Powershell command prompt on the DC
2. Run the command: Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Windows\RecoveryManagerAD\EriAgent.exe"

1. Open gpedit.msc on the DC
2. Navigate to Computer Configuration | Administrative Templates |  Windows components | Windows Defender Antivirus | Windows Defender Exploit Guard | Attack Surface Reduction
3. Double click Configure Attack surface reduction rules
4. Click Show
5. Navigate to 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
6. Set the value to 0 and click OK
7. Click Apply and OK
8. Reboot the DC

A warning similar to the following my be logged in the Operation event for Windows Defender: Windows Defender Antivirus has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 Detection time: 2019-10-02T10:46:24.983Z User: NT AUTHORITY\SYSTEM Path: C:\Windows\System32\lsass.exe Process Name: C:\Windows\RecoveryManagerAD\EriAgent.exe Signature Version: 1.303.624.0 Engine Version: 1.1.16400.2 Product Version: 4.18.1908.7