Windows business users report deleted items in start menu and taskbar

Windows users, including those within companies that use Microsoft 365 and Defender, may experience application shortcuts that spontaneously disappear from the start menu or taskbar. Microsoft has issued an advisory to contain the issue.

In a explanation sent to admins, Microsoft says it has received reports that a certain attack surface reduction rule with the description ‘Block Win32 API calls from Office macro’ is responsible for this. In the meantime Microsoft recommends to set that asr rule to ‘Audit Mode’ to further limit the impact. It is also possible to enable disabled mode for the rule.

Microsoft reported rather that it investigates the mentioned issue, which may cause shortcut icons to not appear or work. In addition, the company already indicated that it is investigating whether recent changes to Microsoft Defender are the cause of the problem. The problem seems to be centered around a recent update of Windows Defender, specifically update KB2267602.

The proposed adjustment will not completely eliminate the problem and will at most prevent the problem from persisting. Microsoft has not yet made a definitive workaround and has not yet given advice to admins on how to get the missing shortcuts visible and working again. Company say that a rollback has been initiated that could take several hours.