---
title: Submit cab files related to Windows Defender EG problems
description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
ms.date: 05/30/2018
---

# Collect diagnostic data for Windows Defender Exploit Guard file submissions

**Applies to:**

- Windows 10, version 1709 and later
- Windows Server 2016

**Audience**

- IT administrators

This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using Windows Defender Exploit Guard. 

In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [Network protection](network-protection-exploit-guard.md).

Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md) 
- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md) 



1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:

    1. Open an administrator-level version of the command prompt:
        
        1. Open the **Start** menu.
        
        2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
        
        3. Enter administrator credentials or approve the prompt.
        
    2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
        
        ```Dos
        cd c:\program files\windows defender
        ```
    
    3. Enter the following command and press **Enter**
        
        ```Dos
        mpcmdrun -getfiles
        ```
    
    4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.

2. Attach this .cab file to the submission form where indicated.


## Related topics

- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md) 
- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md) 
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)