MDE Toolkit 3.3.2

• Attack Surface Reduction release. The ASR page becomes a two-page workspace — an overview that finally tells you what mode every rule is in and where that configuration came from, and a new Events page for investigating blocks and tuning them. Admins can create audited, expiring exclusions directly from an event.

🐛 Fixes

• Temporary exclusions never expired. Remove-MpPreference matches the ASR rule ID case-sensitively — given the wrong case it exits 0, logs nothing, and removes nothing. The expiry sweep normalised the GUID to lowercase, so every temporary exclusion silently outlived its expiry. Defender keeps whatever case was originally written, so the toolkit now reads the stored ID back and echoes its exact casing. A failed revert is also retried on the next sweep instead of being stranded permanently.
• Exclusion counts were badly under-reported. Get-MpPreference returns rule-specific exclusions |-separated while the registry uses >; only the latter was handled, so a rule with ten excluded paths counted as one.
• Overlapping exclusions no longer corrupt each other. Defender keys exclusions by (rule, path) with no reference count, so two ledger entries shared one Defender entry, an expiring temporary exclusion could silently revoke a permanent one. Expiry is now reference-aware and duplicates are blocked at creation.
• Collection interval mismatch. The code default was 60 minutes while the documentation, the installer seed and the scheduled-task cadence all said 480 (8 hours), so MSI-installed devices collected every 8 hours but devices without the registry value collected hourly. The code now matches at 480.
• Render-thread crashes are survivable. The application had no global exception handling, so a transient GPU driver or display-topology fault (UCEERR_RENDERTHREADFAILURE) terminated the process mid-investigation. These are now absorbed and logged to %LOCALAPPDATA%\MDE-Toolkit\diagnostics.log, falling back to software rendering only after repeated failures. Other exceptions are logged but deliberately not suppressed.
• Fixed a crash (NullReferenceException in ListCollectionView.PrepareLocalArray) when loading ASR data.

🔒 Enterprise guardrails for ASR exclusions
New optional policy values under HKLM\SOFTWARE\Policies\MDE-Toolkit restrict what admins may create. A device with none of them set behaves exactly as before.

• AsrAllowPermanentExclusions (DWORD, default 1) — 0 forces every exclusion to expire.
• AsrAllowTemporaryExclusions (DWORD, default 1) — set both flags to 0 to disable exclusion creation entirely.
• AsrExclusionMaxHours (DWORD, default 0 = uncapped) — hard cap, applied last so it cannot be widened by the list below.
• AsrExclusionDurationsHours (SZ, default 4,24,168,720) — custom duration menu; unparseable entries are ignored and reported rather than silently dropped.
• ForceReadOnlyMode was previously documented but never enforced. It now blocks every exclusion write, creation and removal alike.
• Enforcement happens in the apply path, not just the dropdown, so the policy is not merely cosmetic. Temporary-only with a four-hour cap is two values: AsrAllowPermanentExclusions=0 and AsrExclusionMaxHours=4.

🔒 Two flags now actually work

• DisableRemoteTarget now pins the toolkit to the local machine. Enforcement sits in the TargetMachine setter rather than on the text box, because that setter is the single choke point every remote-capable service reads from — roughly thirty services branch on it. A non-local value is rejected and coerced back to localhost, so no remote path is reachable even if a future caller sets the target in code. The Target box is also disabled, with a tooltip naming the policy.
• DisableExportButtons now blocks every export path: report PDF/HTML, triage report, scan results, ASR event CSV, Advanced Hunting CSV and XML, supplemental and merged App Control policies, WDAC XML, firewall migration JSON, and investigation details CSV. Blocked attempts show a dialog naming the policy, so the button does not simply appear broken.