Microsoft 365 Installation Problems

Fix Microsoft 365 Installation Hanging at 2% Due to ASR Rules

Natalie Taylor Oct 10, 2026 868 views

Question details

The user needs to know how to proceed when their Microsoft 365 installation deployment halts permanently at 2% progress due to an Intune Attack Surface Reduction rule.

How to Fix Microsoft 365 Installation Hanging at 2% Because of an ASR Rule

Product: Microsoft 365
Device & OS: not provided
Scenario: Deploying Microsoft 365 in a business or enterprise environment managed by Intune with active ASR security policies.
Observed behavior: The installation process gets stuck exactly at 2% because a security rule blocks the Windows Installer (msiexec.exe) from executing necessary deployment tasks.

Before you start

Ensure you have Intune administrator privileges and document your current Attack Surface Reduction (ASR) configurations before requesting or applying any policy modifications.

Solution 1Recommended

Request a Vendor-Recommended ASR Rule Exception

Instead of creating a broad exclusion that compromises system security, consult Microsoft Support or the Defender Community for a targeted exception tailored to your deployment.

The 'Block Credential Stealing from the Windows Local Security Authority Subsystem' rule is often responsible for blocking msiexec.exe during the Office deployment process. Because msiexec.exe is a prime target for malware, you must never exclude it globally.

Identify the blocking rule

Log into your Microsoft Endpoint Manager admin center, navigate to Endpoint Security > Attack Surface Reduction, and review the logs to confirm which specific rule is blocking msiexec.exe.

Visit the appropriate support channel

Go to the Microsoft 365 Defender Community forum or open your Microsoft 365 Admin Center to access the official support portal.

Submit a detailed support request

Create a new thread or support ticket stating that your Microsoft 365 installation hangs at 2% due to the 'Block Credential Stealing' ASR rule blocking your deployment.

Apply the targeted fix

Wait for the Microsoft support team to provide a vendor-approved, scoped exception or script to bypass the restriction securely without globally exposing msiexec.exe.

Request a Vendor-Recommended ASR Rule Exception

Security Warning: Never fully disable the ASR rules or create a broad exclusion for msiexec.exe, as this severely weakens your network's defense against malicious payloads.

Free Microsoft Office alternative

Deploy WPS Office as a Lightweight, Hassle-Free Alternative

If complex Intune deployments and strict ASR rules are causing enterprise installation headaches, consider WPS Office. It provides a lightweight, easy-to-deploy suite that seamlessly handles your document needs without the heavy footprint.

1. Download the installer: Visit the official WPS Office website and download the free installation package.
2. Run the setup: Execute the lightweight setup file, which installs quickly without triggering complex system-level conflicts.
3. Start editing: Open your existing Word, Excel, or PowerPoint files instantly and continue working securely.

Fully compatible with Microsoft Office formats including DOCX, XLSX, and PPTX.Lightweight installation package that simplifies enterprise deployment.Familiar user interface ensuring zero learning curve for your team.Free to use, significantly reducing software licensing overhead.

microsoft office alternative - wps office

Frequently Asked Questions

Why does the Microsoft 365 installation freeze exactly at 2%?

The 2% mark is typically when the Office Deployment Tool hands over the installation process to the Windows Installer (msiexec.exe). If an Attack Surface Reduction (ASR) rule blocks this executable, the process cannot continue, resulting in a hang.

Can I temporarily disable the ASR rule to let the installation finish?

While it is technically possible to temporarily disable the rule via Intune, doing so across your organization creates a vulnerable window. It is highly recommended to consult Microsoft Support for a targeted deployment strategy instead.

Which specific ASR rule causes this conflict?

The most common culprit is the 'Block Credential Stealing from the Windows Local Security Authority Subsystem' rule, which intervenes when the installer attempts to execute necessary system-level changes.

Where is the best place to report Microsoft 365 Intune deployment bugs?

For business and enterprise users, the Microsoft 365 Defender Community is the most appropriate channel to discuss ASR rules, alongside opening an official support ticket through your Microsoft 365 Admin Center.

Installation & Activation