MicrosoftI have set the warn mode for some of the rules and the user got warned but unable to unblock it. When they hit unblock, nothing happened. There are 1000s of user got affected with this warn mode setting. We tested in house with small group of users before scoping the profile to all users but large number of users out there got affected. Following rules were set to Warn Mode
Block Win32 API calls from Office macros
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
[PREVIEW] Block use of copied or impersonated system tools
Below screenshots shows what happened.
