Knowledge base KB0233

Conflict with Windows Defender: "A think-cell update has been installed…"


After a Windows update, I am unable to open the internal datasheet of think-cell. When I insert a new think-cell chart or double-click an existing think-cell chart, I see the following message:

a think-cell update has been installed

I already restarted my PC, but the problem continues to occur.


  1. Is think-cell installed in the user account, e.g., C:\Users\[your_username]\AppData\Local\think-cell?
    You can find your think-cell install directory in PowerPoint: Insertthink-cellMore More MenuAbout

  2. If yes, open the Event Viewer and go to the following path:
    Application and Services LogsMicrosoftWindowsWindows DefenderOperational
    Scroll down until you see a Warning. Click on the Warning and check if the General tab shows the path to think-cell's tcasr.exe and the ID: 3B576869-A4EC-4529-8536-B80A7769E899 as shown in the following screenshot:

    Event Viewer General Tab


The following Windows Defender ASR rule blocks the execution of think-cell's tcasr.exe and deletes it:

  • 3B576869-A4EC-4529-8536-B80A7769E899
    (Block Office applications from creating executable content)

Afterwards opening the internal datasheet does not work anymore, sending an email via Send Slides… or Request Support… fails with a similar error message.


  • Ask your internal IT to allow the execution of think-cell's tcasr.exe in your think-cell installation path, most likely %localappdata%\think-cell. Afterwards reinstall think-cell to restore the tcasr.exe.

  • Alternatively, uninstall your existing think-cell installation and reinstall it as administrator. The problem does not occur with per-machine installations.

  • We are currently in contact with Microsoft to find a solution for the tcasr.exe getting deleted. If your company has a Microsoft Office support contract and you want to contact Microsoft with further inquires about the issue, you may refer to case number 120081824003059.

Contact Support

In case think-cell is installed as administrator, if you cannot find the Warning in the Event Viewer or if you are still experiencing issues after following the steps in Solution, please contact our support team:

Please send us your think-cell log files for analysis. Since Request Support… does most likely not work, you can find the logs as explained below:

  • Open a new Windows Explorer window and type


    into the address field and press Enter.

  • Please send all files with the extension .log contained in this folder to our support team. This may be any of the following files: POWERPNT_log.log, EXCEL_log.log, TCMAIL_log.log, TCUPDATE_log.log, TCRUNXL_log.log, PPTTC_log.log, setup_think-cell_xxxxx_log.log.
  • If you want to browse to the directory:

    The full default filepath is C:\Users\[USERNAME]\AppData\Local\think-cell. If you cannot find this, it is probably set to invisible. You can change that in Windows Explorer by checking:

    • Windows 7:
      OrganizeFolder and search optionsViewShow hidden files and folders.
    • Windows 8, Windows 8.1 and Windows 10:
      ViewShow/hideHidden Items.

    In addition, if think-cell is active, please click on More More MenuAbout in the think-cell toolbar and send us a screenshot of the think-cell info window.

think-cell uses cookies to improve the functionality, performance and security of this site. Your consent is necessary if you want to use the full functionality of this site. More information on the use of cookies by think-cell, your consent and your privacy rights can be found in our privacy policy.