Knowledge base KB0233

Conflict with Windows Defender: "A think-cell update has been installed..."


After a Windows update, I am unable to open the internal datasheet of think-cell. When I insert a new think-cell chart or double-click an existing think-cell chart, I see the following message:

a think-cell update has been installed

I already restarted my PC, but the problem continues to occur.


  1. Is think-cell installed in the user account, e.g., C:\Users\[your_username]\AppData\Local\think-cell?

    You can find your think-cell install directory in PowerPoint: Insertthink-cellMore More Menu About

  2. If yes, open the Event Viewer and go to the following path:

    Application and Services LogsMicrosoftWindowsWindows DefenderOperational

    Scroll down until you see a Warning. Click on the Warning and check if the General tab shows the path to think-cell's tcasr.exe and the ID: 3B576869-A4EC-4529-8536-B80A7769E899 as shown in the following screenshot:

    Event Viewer General Tab


The following Windows Defender ASR rule blocks the execution of think-cell's tcasr.exe and deletes it:

  • 3B576869-A4EC-4529-8536-B80A7769E899
    (Block Office applications from creating executable content)

Afterwards opening the internal datasheet does not work anymore, sending an email via Send Slides… or Request Support… fails with a similar error message.


The problem was fixed by Microsoft. It does not occur with the security intelligence version 1.327.1434.0 or later. To verify your Windows Defender security intelligence version, go to Windows Start → SettingsUpdate & SecurityWindows SecurityVirus & threat protectionSettingsAbout. The latest security intelligence update is available for download on Microsoft's website.


  • Ask your internal IT to allow the execution of think-cell's tcasr.exe in your think-cell installation path, most likely %LOCALAPPDATA%\think-cell. Afterwards reinstall think-cell to restore the tcasr.exe.

  • Alternatively, uninstall your existing think-cell installation and reinstall it as administrator. The problem does not occur with per-machine installations.

Contact support

In case think-cell is installed as administrator, if you cannot find the Warning in the Event Viewer or if you are still experiencing issues after following the steps in Solution, please contact our support team:

Please send us your think-cell log files for analysis. Since Request Support… does most likely not work, you can find the logs as explained below:

  • Open a new Windows Explorer window, type


    into the address field, and press Enter

  • Please send all files with the extension .log contained in this folder to our support team.

    This may be any of the following files: POWERPNT_log.log, EXCEL_log.log, TCMAIL_log.log, TCUPDATE_log.log, TCRUNXL_log.log, TCASR_log.log, PPTTC_log.log, setup_think-cell_xxxxx_log.log.

  • If you want to browse to the directory:

    The full default filepath is C:\Users\[USERNAME]\AppData\Local\think-cell. If you cannot find this, it is probably set to invisible. You can change that in Windows Explorer by checking:

    • Windows 7:
      OrganizeFolder and search optionsViewShow hidden files and folders.
    • Windows 8, Windows 8.1 and Windows 10:
      ViewShow/hideHidden Items.

    In addition, if think-cell is active, please click on More More Menu About in the think-cell toolbar and send us a screenshot of the think-cell info window.


think-cell uses cookies to improve the functionality, performance and security of this site. Your consent is necessary if you want to use the full functionality of this site. More information on the use of cookies by think-cell, your consent and your privacy rights can be found in our privacy policy.