Attack Surface Reduction (ASR) blocking PowerToys.PowerLauncher for Microsoft.Edit

### Microsoft PowerToys version

0.99.1

### Installation method

WinGet

### Area(s) with issue?

General

### Steps to reproduce

Each time I boot my Windows 11 device and log in to my user profile I get an error from Microsoft Defender Exploit Guard about PowerToys.PowerLauncher being blocked by an Attack surface surface reduction rule. The error is logged in the event log under `Microsoft-Windows-Windows Defender/Operational` with Event ID `1121`

```text
Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
For more information please contact your IT administrator.
ID: C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB
Detection time: 2026-05-03T09:33:37.763Z
User: AzureAD\userName
Path: C:\Users\userName\AppData\Local\Microsoft\WinGet\Packages\Microsoft.Edit_Microsoft.Winget.Source_8wekyb3d8bbwe\edit-2.0.0-x86_64-windows\edit.exe
Process Name: C:\Users\userName\AppData\Local\PowerToys\PowerToys.PowerLauncher.exe
Target Commandline:
Parent Commandline: "C:\Users\userName\AppData\Local\PowerToys\PowerToys.PowerLauncher.exe" -powerToysPid 17524 --started-from-runner
Involved File:
Inheritance Flags: 0x00000000
Security intelligence Version: 1.449.398.0
Engine Version: 1.1.26030.3008
Product Version: 4.18.26030.3011
```

I have updated to Microsoft Edit v2.0.0 using WinGet in the past week and since then I get this error. However, since the ASR-rule kicks in on PowerToys,PowerLauncher.exe, it seemed logical to report this issue to the PowerToys team.

My device is Entra joined to my organization and managed by the company with Microsoft Intune. These ASR-rules have been configured quite a while ago, and only since last week, the ASR-rule is triggered.

### ✔️ Expected Behavior

no warnings from Microsoft Defender

### ❌ Actual Behavior

Microsoft Defender blocking PowerLauncher

### Upload Bug Report ZIP-file

_No response_

### Additional Information

- Windows 11 25H2 build 26200.8246
- Entra Joined, managed by organization with Microsoft Intune
- English language
- bug report: [PowerToysReport_2026-05-03-11-37-48.zip](https://github.com/user-attachments/files/27315880/PowerToysReport_2026-05-03-11-37-48.zip)

### Other Software

- Microsoft Edit v2.0.0

Start with the Microsoft Defender Operational event log entry for Event ID 1121 and the attached PowerToysReport ZIP, comparing the PowerLauncher and Microsoft Edit v2.0.0 details. Investigate the reported ASR block after the Edit update; done means identifying whether PowerLauncher is responsible and preventing the warning without breaking startup.

Written by the indexing model from the issue text.