mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-22 18:27:23 +00:00
70 lines
2.9 KiB
Markdown
70 lines
2.9 KiB
Markdown
---
|
|
title: Submit cab files related to Windows Defender EG problems
|
|
description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
|
|
keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
|
|
search.product: eADQiWindows 10XVcnh
|
|
ms.pagetype: security
|
|
ms.prod: w10
|
|
ms.mktglfcycl: manage
|
|
ms.sitesec: library
|
|
ms.pagetype: security
|
|
ms.localizationpriority: medium
|
|
author: andreabichsel
|
|
ms.author: v-anbic
|
|
ms.date: 04/30/2018
|
|
---
|
|
|
|
# Collect diagnostic data for Windows Defender Exploit Guard file submissions
|
|
|
|
**Applies to:**
|
|
|
|
- Windows 10, version 1709 and later
|
|
|
|
**Audience**
|
|
|
|
- IT administrators
|
|
|
|
This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using Windows Defender Exploit Guard.
|
|
|
|
In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [Network protection](network-protection-exploit-guard.md).
|
|
|
|
Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
|
|
- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md)
|
|
- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md)
|
|
|
|
|
|
|
|
1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:
|
|
|
|
1. Open an administrator-level version of the command prompt:
|
|
|
|
1. Open the **Start** menu.
|
|
|
|
2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
|
|
|
|
3. Enter administrator credentials or approve the prompt.
|
|
|
|
2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
|
|
|
|
```Dos
|
|
cd c:\program files\windows defender
|
|
```
|
|
|
|
3. Enter the following command and press **Enter**
|
|
|
|
```Dos
|
|
mpcmdrun -getfiles
|
|
```
|
|
|
|
4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
|
|
|
|
2. Attach this .cab file to the submission form where indicated.
|
|
|
|
|
|
## Related topics
|
|
|
|
- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md)
|
|
- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md)
|
|
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
|
|
|