Microsoft ASR (Attack Surface Reduction) Flags ppidrv64.sys and Blocks Graphics Driver Install
Content Type: Install & Setup | Article ID: 000095828 | Last Reviewed: 09/04/2024
In a corporate environment, Microsoft ASR (Attack Surface Reduction) is blocking the installation of latest graphics drivers like 101.4369. It seems to be caused by the file “ppidrv64.sys” (in Resources > Extras folder) being signed by Microsoft in 2019 and is not accepted by Microsoft Defender/Endpoint Security. Earlier versions did not have this issue.
Risky action blocked
App or process blocked: gfx_win_101.4369.exe
Blocked by: Attack surface reduction
Rule: Block MS use of in-the-wild exploited vulnerable signed drivers
Affected Items: C:\Users\<user>\AppData\Local\Temp\7zS8851F47\Resources\Extras\piddrv64.sys
The ppidrv64.sys file has been removed as of graphics driver 31.0.101.4575 and future releases until this issue is resolved.