How to get Policy "Windows VMs should enable ADE or EncryptionAtHost." to be compliant?

AzureToujoursPolicy won't be applied until there is a change in state to the resources it is being applied to. Policy by itself is just a written rule, so something has to trigger the application of that rule. If you were to enforce the encryption policy at the Resource Group level and then create a new Windows VM it would be encrypted because the create operation would trigger the rule. Policy can be used to remediate non-compliant resources using the DeployIfNotExists effect, if you supply the policy with the template it should apply to fix the problem.