Forum Discussion
ASRs via Intune not working (only on Windows 11 Clients)
That's just a UI thing. The ASR you mentioned is supported on W11: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#asr-rules-supported-operating-systems
Hi Jordi_Koenderink, the problem is that even when I hunt for the ASRs in MS Defender, it shows that the setting Block all Office applications from creating child processes is off(there are 2 more settings). But according to our settings, this should not be the case. It also works on the Windows 10 devices, as set.
- Not sure what you're saying here. The ASR is showing as Off in the Advanced Hunting tab but you set it to On regardless? If so, what does your query look like?
Yes, the notebooks are all in the same configuration group and all get the same settings.
On the Windows 10 devices, the three settings are set to Audit. On the Windows 11 devices, they are displayed as off.
See as an example a Win10 device and a Win11 device. The remaining settings are all the same.
See also the query in the screenshot.an other query:
